CVE-2026-112353 in KerioConnect
Summary
by MITRE • 10/27/2026
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in GFI KerioConnect versions prior to 10.0.8 Patch 2 represents a critical security flaw within its Webmail component, specifically classified under CWE-79 for Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. This stored cross-site scripting (XSS) vulnerability arises from insufficient input validation and sanitization mechanisms when processing email attachments. The core technical failure lies in the application's inability to properly neutralize event-handler attributes within Scalable Vector Graphics files, commonly referred to by their file extension SVG. When a user uploads or receives an email containing a crafted SVG attachment, the system fails to strip malicious JavaScript code embedded within these graphic elements, allowing the script payload to persist on the server side and subsequently execute in the context of any authenticated user who views the message.
The operational impact of this vulnerability is severe due to its stored nature, which means that once an initial victim uploads or receives the malicious attachment, subsequent users viewing the email are automatically targeted without requiring further interaction beyond opening the message. The exploitation chain leverages a secondary weakness in the temporary-download endpoint associated with file attachments. This endpoint lacks adequate Content-Security-Policy sandboxing restrictions, effectively allowing inline scripts to execute even when standard CSP headers might otherwise mitigate such risks. By bypassing these security controls through specific SVG attribute manipulation, attackers can inject arbitrary JavaScript that runs within the victim's authenticated session context.
This capability enables remote attackers to perform sophisticated attacks against targeted organizations. As observed by Proofpoint Threat Research in active exploitation campaigns, this vulnerability is being weaponized as a credential and mailbox stealer. The injected scripts are designed to exfiltrate sensitive data directly from the browser memory of the compromised user. This includes stealing session cookies that allow for session hijacking, capturing login credentials entered into web forms, and potentially scraping email contents stored in local storage or accessible via API calls within the application's frontend logic. Such theft compromises not only individual account security but also facilitates broader lateral movement and data breach scenarios within enterprise environments relying on KerioConnect for communication.
Mitigation strategies must prioritize immediate patching to version 10.0.8 Patch 2 or later, where these sanitization issues have been addressed by the vendor. In addition to software updates, organizations should implement strict Content-Security-Policy headers that enforce nonces or hashes and disable inline script execution across all webmail endpoints. Network-level controls such as Web Application Firewalls can be configured to detect and block SVG files containing suspicious event handlers like onerror or onload attributes. Furthermore, security awareness training for users regarding the risks of opening unexpected email attachments remains a vital layer of defense against social engineering tactics that often precede technical exploitation of this flaw.