---
id: CVE-2026-65053
title: >-
  Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment
  name into an HTML status block without escaping it
summary: >-
  Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment
  name into an HTML status block without escaping it. In
  lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data
  part with IMP_Contents::getPar…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-08-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-65053'
references:
  - url: 'https://blog.evan.lat/posts/CVE-2026-65053/'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/horde/imp/commit/f31449a12e3f945c90015d29524925c4c43f6324
    label: disclosure@vulncheck.com
  - url: 'https://github.com/horde/imp/pull/107'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/horde/imp/releases/tag/v7.2.0'
    label: disclosure@vulncheck.com
  - url: 'https://www.horde.org/apps/imp'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/horde-imp-before-stored-cross-site-scripting-via-appledouble-viewer-part-name
    label: disclosure@vulncheck.com
  - url: 'http://seclists.org/fulldisclosure/2026/Aug/115'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00412
epssPercentile: 0.32629
ingestedAt: '2026-09-24T20:51:40.222Z'
---

## Overview

Horde IMP's AppleDouble MIME viewer writes an attacker-controlled attachment name into an HTML status block without escaping it. In lib/Mime/Viewer/Appledouble.php, _IMPrender() obtains the name of the data part with IMP_Contents::getPartName(), which returns the MIME part's own name parameter as supplied by the message, and passes it through sprintf into the text of an IMP_Mime_Status object. IMP_Mime_Status::__toString() concatenates each text entry directly into the surrounding table markup, so the value reaches the rendered page verbatim. A message crafted as multipart/appledouble whose data part carries markup in its name parameter therefore executes script in the context of any user who views it, and the payload persists in the mailbox. Exploitation requires no account on the target system, only the ability to send mail to a user. Version 7.2.0 escapes the value with htmlspecialchars(). The researcher additionally chains this flaw with the arbitrary file read of CVE-2026-58451, and reports that script running in an administrator's session can reach an application code-execution path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.