Vulnerability · Published Jul 1, 2026 · Assigned by VulnCheck

CVE-2026-58451Horde IMP < 7.0.1 Path Traversal via Compose.php img src

Medium 6.5

In plain English

A medium-severity path traversal in imp from horde. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.6%top 52.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Horde IMP before 7.0.1 contains a path traversal vulnerability in lib/Compose.php that allows authenticated attackers to read arbitrary files from the server filesystem by embedding traversal sequences after a CKEditor path prefix in img src URLs. Attackers can bypass the stripos() prefix validation by appending sequences such as traversal segments after the matching prefix, causing file_get_contents() to read sensitive files whose contents are then exfiltrated as MIME parts in outgoing email; unauthenticated exploitation is also achievable via CSRF against an active authenticated session.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	php-horde-imp	no fix listed	DEBIAN-CVE-2026-58451

Affected products (as reported)

Vendor	Product	Versions
horde	imp	0 – before 7.0.1

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References

Release Notes release-notes
Fix PR issue-tracking
Fix Commit patch
Project Webpage product
https://www.vulncheck.com/advisories/horde-imp-path-traversal-via-compose-php-img-src third-party-advisory
Researcher Disclosure technical-description, exploit
http://seclists.org/fulldisclosure/2026/Jul/8