Horde IMP’s AppleDouble MIME viewer inserts the attachment name from a multipart/appledouble message directly into an HTML status block without escaping. Because the name can contain arbitrary markup, a crafted message can place script into the page markup. Once stored in a user’s mailbox, the script executes any time the user opens the message, allowing cross‑site scripting in the context of that user. The flaw can also be chained with an unrelated arbitrary‑file‑read flaw to give an attacker code execution when an administrator views the message.

This vulnerability affects all versions of the Horde IMP mail client prior to 7.2.0. The issue was fixed in release 7.2.0, which sanitizes the AppleDouble part name with htmlspecialchars. Administrators should verify that they are running 7.2.0 or later, and otherwise consider the older versions vulnerable.

The CVSS score of 5.1 indicates moderate overall risk, and the EPSS score is currently unavailable, so an estimate of the likelihood of exploitation is uncertain. The flaw is listed as not part of CISA’s Known Exploited Vulnerabilities catalog. Exploitation requires only the ability to send mail to a targeted user; no account or privileged access is needed. The likely attack vector is the injection of a malicious AppleDouble message through the standard SMTP transport, after which the malicious script runs in victim browsers whenever the message is viewed.