Horde IMP before version 7.0.1 contains a directory traversal flaw in the Compose.php file that allows authenticated attackers to supply malicious image URLs in the CKEditor editor. By appending path traversal sequences after the expected CKEditor prefix, the application bypasses a prefix check and reads arbitrary files using file_get_contents. The contents of these files is then encapsulated as MIME parts and sent out in emails, giving an attacker a covert exfiltration channel. The flaw is identified as CWE-22.

All installations of Horde IMP with a version earlier than 7.0.1. The vulnerability manifests in the lib/Compose.php component and applies to any deployment that uses CKEditor image URLs for email composition.

The CVSS score of 7.1 indicates substantial impact, with the risk compounded by the fact that the attack requires user authentication, which is commonly present on mail servers. The EPSS score of < 1% suggests a very low but nonzero probability of exploitation; however, the absence of a KEV listing does not diminish the practical threat, as the flaw can be leveraged via CSRF to obtain the privileges of an active authenticated session, effectively enabling environments that do not promptly apply the patch.