CVE-2026-65053 horde CVE debrief

Who should care

Defenders responsible for Horde IMP installations should assess exposure and prioritize upgrading to version 7.2.0 or applying compensating controls. Operators of affected systems should review and update their security controls to prevent exploitation. Vulnerability management teams should verify exposure and prioritize remediation. Security teams should ensure proper security controls are in place and monitor for suspicious activity.

Why it matters

CVE-2026-65053 is a stored cross-site scripting vulnerability in Horde IMP's AppleDouble MIME viewer. Defenders should prioritize verifying exposure and upgrading to version 7.2.0 or applying compensating controls to prevent exploitation.

• Script execution in the context of any user who views the message
• Payload persistence in the mailbox
• Potential for chaining with other vulnerabilities
• Verification of exposure and remediation priority

Technical summary

The Horde IMP AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. This allows an attacker to execute script in the context of any user who views the message. The vulnerability is fixed in version 7.2.0. An attacker can send a crafted multipart/appledouble message with markup in the data part's name parameter, which will be executed in the context of any user who views it. The payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user.

Defensive priority

Defenders should prioritize verifying exposure of Horde IMP installations to this vulnerability and upgrading to version 7.2.0 or applying compensating controls to prevent exploitation.

Recommended defensive actions

• Verify Horde IMP installations for exposure to this vulnerability
• Upgrade to version 7.2.0 or apply compensating controls
• Monitor for suspicious activity
• Implement additional security measures to prevent exploitation
• Review and update incident response plans
• Conduct a thorough risk assessment
• Ensure proper security controls are in place

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. Additional information is available from the researcher's blog post and the Horde IMP GitHub repository.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.