Horde IMP < 7.0.1 Path Traversal via Compose.php img src
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-58451
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 3 Nov 2026, 15:34 UTC · Revision 1
Source evidence
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
core-osv · Original sourcePublished 1 Jul 2026, 18:16 UTC
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.
osv:CVE-2026-58451
Complete source record
{
"id": "9089858addf837d4c07346e2aeb5ff4f3778627d5ba1e65e381f198c4b0330a2",
"url": "https://osv.dev/vulnerability/CVE-2026-58451",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Horde IMP < 7.0.1 Path Traversal via Compose.php img src",
"summary": "Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.",
"evidence": "osv:CVE-2026-58451",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2026-58451",
"aliases": [
"CVE-2026-58451"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/horde/imp",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "d3f0ce22fb68ccbf0d45ae35b538c0007e047415"
},
{
"fixed": "fba972fab72ee6871e5d56e6390bee38593085de"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "7.0.1"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "d3f0ce22fb68ccbf0d45ae35b538c0007e047415"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v7.0.1"
},
{
"range": [
{
"fixed": "fba972fab72ee6871e5d56e6390bee38593085de"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v7.0.0",
"v7.0.0RC5",
"v7.0.0RC4",
"v7.0.0RC3",
"v7.0.0RC2",
"v7.0.0RC1",
"v7.0.0beta3",
"v7.0.0beta2",
"v7.0.0beta1",
"v7.0.0alpha18",
"v7.0.0alpha17",
"v7.0.0alpha16",
"v7.0.0alpha15",
"v7.0.0alpha14",
"v7.0.0alpha13",
"v7.0.0alpha12",
"v7.0.0alpha11",
"v7.0.0alpha10",
"v7.0.0alpha9",
"v7.0.0alpha8",
"v7.0.0alpha7",
"v7.0.0alpha6",
"v7.0.0alpha5",
"v7.0.0alpha4",
"v7.0.0alpha2",
"v7.0.0alpha1",
"v6.2.0beta2",
"v6.2.0beta1",
"v6.2.0alpha1",
"v6.1.6",
"v6.1.5",
"v6.1.4",
"v6.1.3",
"v6.1.2",
"v6.1.1",
"v6.1.0",
"v6.1.0rc1",
"v6.1.0beta2",
"v6.1.0beta1",
"v6.0.4",
"v6.0.3",
"v6.0.2",
"v6.0.1",
"v6.0.0",
"v6.0.0rc2",
"v6.0.0rc1",
"v6.0.0beta4",
"v6.0.0beta3",
"v5.0.22",
"v5.0.21",
"v5.0.20",
"v5.0.19",
"v5.0.18",
"v5.0.17",
"v5.0.16",
"v5.0.15",
"v5.0.14",
"v5.0.13",
"v5.0.12",
"v5.0.11",
"v5.0.10",
"v5.0.9",
"v5.0.8",
"v5.0.7",
"v5.0.6",
"v5.0.5",
"v5.0.4",
"v5.0.3",
"v5.0.2",
"v5.0.1",
"v5.0.0",
"v5.0.0rc2",
"v5.0.0rc1",
"v5.0.0beta1",
"v5.0.0alpha1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58451.json"
}
}
],
"modified": "2026-10-28T02:30:29.941917781Z",
"provider": "osv",
"references": [
"https://www.horde.org/apps/imp",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58451.json",
"https://github.com/horde/imp/releases/tag/v7.0.1",
"https://nvd.nist.gov/vuln/detail/CVE-2026-58451",
"https://www.vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src",
"https://github.com/horde/imp/pull/85",
"https://github.com/horde/imp/commit/fba972fab72ee6871e5d56e6390bee38593085de",
"https://github.com/horde/imp",
"https://blog.evan.lat/posts/CVE-2026-58451/"
],
"provider_metadata": {
"cwe_ids": [
"CWE-22"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58451.json"
}
},
"related_cves": [
{
"value": "CVE-2026-58451",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 496865,
"published_at": "2026-07-01T18:16:09.328+00:00"
}