Description
GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
Published: 2026-10-28
Score: 5.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:45:00 +0000

Type Values Removed Values Added
Description GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains an HTML injection vulnerability that allows remote attackers to inject malicious markup by crafting emails whose link text contains quote characters, causing the Webmail auto-formatter to break out of the href attribute while re-processing text already inside a link. Attackers can exploit this flaw to spoof link targets or inject arbitrary HTML into the rendered message within a victim's Webmail session. GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.
Title GFI KerioConnect < 10.0.9p2 HTML Injection via Link Auto-Formatter GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
References

Wed, 28 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains an HTML injection vulnerability that allows remote attackers to inject malicious markup by crafting emails whose link text contains quote characters, causing the Webmail auto-formatter to break out of the href attribute while re-processing text already inside a link. Attackers can exploit this flaw to spoof link targets or inject arbitrary HTML into the rendered message within a victim's Webmail session.
Title GFI KerioConnect < 10.0.9p2 HTML Injection via Link Auto-Formatter
Weaknesses CWE-79
CWE-83
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

cvssV4_0

{'score': 5.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-28T16:06:55.255Z

Reserved: 2026-10-19T14:41:46.703Z

Link: CVE-2026-112356

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-28T16:17:01.663

Modified: 2026-10-28T16:17:01.663

Link: CVE-2026-112356

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE-83

    Improper Neutralization of Script in Attributes in a Web Page