CVE-2026-58451— Horde IMP < 7.0.1 Path Traversal via Compose.php img src
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58451
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Horde IMP < 7.0.1 Path Traversal via Compose.php img src
Source: NVD (National Vulnerability Database)
Vulnerability Description
Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-58451
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-58451
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58451 (2)
Vendor Advisories for CVE-2026-58451 (1)
Security Blog Posts for CVE-2026-58451 (1)
Vendor Pages for CVE-2026-58451 (2)
- 🔗 Release 7.0.1 · horde/imp · GitHubrelease-notes
- IMP - The Horde Projectproduct
IV. Related Vulnerabilities
Same product: imp
Same weakness: CWE-22
- CVE-2026-9725
Printcart Web to Print Product Designer for WooCommerce <= 2 - CVE-2026-14352
AR for WooCommerce <= 8.40 - Unauthenticated Path Traversal - CVE-2026-14327
AR for WordPress <= 8.40 - Unauthenticated Arbitrary File Re - CVE-2026-13054
WatchGuard Firebox Arbitrary File Write via Path Traversal i - CVE-2026-52830
fast-mcp-telegram: Bearer token path traversal bypasses rese
V. Comments for CVE-2026-58451
No comments yet