A cross‑site scripting vulnerability in Alinto SOGo 5.12.7 allows a maliciously crafted iCalendar file to inject and execute arbitrary JavaScript in the context of an authenticated webmail session. The flaw occurs because SVG content placed in the calendar description field, especially an onrepeat event handler, is not properly sanitized before rendering, giving the attacker code execution privilege within the victim’s browser. The injected script can grant the attacker access to the user’s mailbox, theft of emails or contacts, session hijacking, and the ability to perform any action that the authenticated user is authorized for.

Alinto SOGo version 5.12.7 is affected. The issue is fixed in the 5.12.8 release.

The vulnerability carries a CVSS score of 6.1, indicating moderate severity, and it is not listed in CISA KEV. No EPSS score is available. Attackers must deliver a malicious iCalendar file and the victim must be logged into the SOGo webmail interface for exploitation. Once the invite is opened, the injected script runs with the victim’s privileges, allowing compromise of that user’s session and data. The simplicity of this delivery method and the potential for full account compromise make remediation a priority even at moderate severity.