CVE-2026-58451 Details
Description
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.
A path traversal vulnerability has been identified in Horde IMP versions prior to 7.0.1. The issue resides in 'lib/Compose.php', where authenticated attackers can read arbitrary files from the server's filesystem. This is achieved by embedding traversal sequences after a CKEditor path prefix in image source URLs. The exploitation bypasses the prefix validation, allowing sensitive files to be accessed and their contents exfiltrated as MIME parts in outgoing emails. Additionally, this vulnerability can be exploited without authentication through Cross-Site Request Forgery (CSRF) targeting an active authenticated session.
Users can update to Horde IMP version 7.0.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 1, 2026CISA-ADP
Assessed Jul 1, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| http://seclists.org/fulldisclosure/2026/Jul/8 | CVE | |
| https://blog.evan.lat/posts/CVE-2026-58451/ | [email protected] | |
| https://github.com/horde/imp/commit/fba972fab72ee6871e5d56e6390bee38593085de | [email protected] | Source CodeVendor |
| https://github.com/horde/imp/pull/85 | [email protected] | Issue TrackingVendor |
| https://github.com/horde/imp/releases/tag/v7.0.1 | [email protected] | Release NotesVendor |
| https://www.horde.org/apps/imp | [email protected] | ProductVendor |
| https://www.vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src | [email protected] | AdvisoryBundleRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Horde IMP | < 7.0.1 (semver) |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 2, 2026 | CVE Modified | CVE |
| Jul 2, 2026 | CVE Modified | [email protected] |
| Jul 1, 2026 | New CVE Received | [email protected] |
| Jul 1, 2026 | CVE Modified | CISA-ADP |