CVE-2026-97735 ITFlow CVE debrief

Who should care

Defenders responsible for ITFlow installations should assess exposure and potential impact. This includes evaluating the email parser's functionality, considering compensating controls, and verifying vulnerability in their specific environments. Security teams and vulnerability management teams should prioritize this vulnerability due to its high severity and potential for malicious execution or impact on emailparser

Why it matters

CVE-2026-97735 is a high-severity vulnerability in ITFlow that allows SVG attachments in the ticket email parser, potentially leading to malicious execution or impact on email parser functionality. Defenders should prioritize verifying exposure and assessing potential impact.

• Potential for malicious SVG attachments to be executed.
• Possible impact on email parser functionality.

Technical summary

CVE-2026-97735 is a vulnerability in ITFlow before version 26.08 that allows SVG attachments in the ticket email parser. This could potentially lead to malicious execution or impact on email parser functionality. The vulnerability's technical details are limited, but it is classified as high-severity with a CVSS score of 8. Defenders should focus on verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact.

Recommended defensive actions

• Verify exposure by checking if the ITFlow installation is vulnerable.
• Assess potential impact by evaluating the email parser's functionality.
• Consider implementing compensating controls to mitigate potential risks.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Evidence is limited to official CVE metadata and NVD assessments. Defenders should verify exposure and assess potential impact by checking ITFlow installations, evaluating email parser functionality, and considering compensating controls. The source references provided may offer additional context but have not been reviewed for further details.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.