ITFlow, before version 26.08, processes email tickets through a cron job that parses attachments without verifying their file type. When an attacker sends an email containing a specially crafted SVG file, the parser accepts it and stores the payload, which can later be rendered in the web interface. This provides a foothold for in‑browser attack vectors such as Cross‑Site Scripting, enabling theft of user sessions or execution of arbitrary code within the context of the application. The weakness is a classic input validation flaw, identified as CWE‑79.

The vulnerability affects ITFlow installations of any version earlier than 26.08. The software is provided under the ITFlow product name.

The CVSS score of 8 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the ability to abuse the SMTP interface is accessible by any remote user who can send an email. Attackers can simply transmit a bad SVG attachment to the monitored email address, causing the cron job to store it. Once stored, a normal user browsing the ticket in the web UI could trigger the payload, giving the attacker the same privileges as that user. Because the flaw lies in client‑side rendering, it cannot be exploited without direct user interaction with the interface, but the fact that the SVG is accepted from any sender reduces the barrier to entry.