SOGo versions prior to 5.12.5 contain a flaw that allows an attacker to inject malicious scripts through the names of categories for events, tasks, and contacts. The application concatenates the category data directly into HTML pages without proper escaping, so a crafted category name can trigger arbitrary client‑side code when viewed by a user. This can lead to theft of session cookies, credential hijacking, or redirecting the user to malicious sites.

The affected product is Alinto’s SOGo mail/calendar application. All releases before version 5.12.5 are vulnerable; upgrading to 5.12.5 or later removes the issue.

The CVSS score of 6.4 indicates moderate severity while the EPSS score of less than 1 % shows a low likelihood of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is through the web interface; an attacker who can supply a crafted category name that the application renders without escaping can execute arbitrary JavaScript in the victim’s browser.