A crafted SVG email attachment uploads to the Webmail component and bypasses sanitization of event‑handler attributes, allowing a remote adversary to run JavaScript in the victim’s authenticated session. The execution of arbitrary script can exfiltrate login credentials and mailbox contents. This cross‑site scripting flaw is a classic stored XSS scenario that jeopardizes confidentiality of user data.

The vulnerability exists in GFI KerioConnect (Kerio Connect) versions prior to 10.0.8 Patch 2. Systems running the older product build without the patch are susceptible. The vendor is GFI USA, LLC.

The CVSS score is 6.2, indicating a moderate severity. EPSS data is not available and the flaw is not listed in CISA’s KEV catalog. Proofpoint Threat Research has documented real‑world exploitation for credential and mailbox theft, suggesting that attackers can exploit the temporary‑download endpoint’s weak Content‑Security‑Policy sandbox when the SVG attachment is opened. The likely attack vector involves a legitimate or compromised user receiving a malicious email and opening the attachment within Webmail.