Vulnerability · Published Oct 27, 2026 · Assigned by VulnCheck
CVE-2026-112353GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
High 8.2
In plain English
A high-severity cross-site scripting in GFI KerioConnect from GFI USA, LLC. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 16% of all known vulnerabilities).
Official description
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| GFI USA, LLC | GFI KerioConnect | 0 – before 10.0.8p2 |
Weakness: CWE-79, CWE-83 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
- Release Notes release-notes, patch
- VulnCheck Advisory: GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment third-party-advisory