---
id: CVE-2026-8496
title: >-
  A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 
  5.12.7
summary: >-
  A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version 
  5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary
  JavaScript execution within the authenticated SOGo webmail session. The issue
  occurs …
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
published: '2026-05-13'
updated: '2026-08-06'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8496'
references:
  - url: >-
      https://github.com/Alinto/sogo/commit/67ce01ec2a1a7854d8e9f615dd65afb949043e86
    label: cret@cert.org
  - url: 'https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.8'
    label: cret@cert.org
  - url: 'https://www.sogo.nu/news/2026/sogo-v5128-released.html'
    label: cret@cert.org
  - url: 'https://www.kb.cert.org/vuls/id/487613'
    label: af854a3a-2127-422b-91ae-364da2661108
tags:
  - nvd
epss: 0.00506
epssPercentile: 0.40588
ingestedAt: '2026-08-06T23:06:29.781Z'
---

## Overview

A cross-site scripting (XSS) vulnerability exists in Alinto SOGo, version  5.12.7. A maliciously crafted ICS calendar invitation files allows arbitrary JavaScript execution within the authenticated SOGo webmail session. The issue occurs because SVG content embedded in the description field of an ICS file, with an onrepeat event handler, is insufficiently sanitized before being rendered in the webmail interface. A remote attacker can execute JavaScript in the victim's browser when the malicious calendar invite is viewed.  Successful exploitation may allow mailbox access, email and contact theft, session hijacking, and other actions allowed by an authenticated user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.