CVE-2025-30349

Horde IMP webmail through version 6.2.27, as used with Horde Application Framework through 5.2.23, contains a cross-site scripting flaw (CWE-79) in its handling of text/html email messages. An attacker triggers the flaw by sending a crafted HTML email whose onerror attribute executes attacker-controlled JavaScript — which may be base64-encoded — when the message is rendered. Successful exploitation leads to account takeover of the victim's webmail session, letting the attacker read mail, act as the user, and potentially pivot to other services sharing the credentials. Any installation running IMP up to and including 6.2.27 with Horde Application Framework up to and including 5.2.23 is affected. The flaw was exploited in the wild in March 2025, carries a high probability of near-term exploitation (EPSS 31.3%, 98th percentile), and is not yet listed in CISA KEV, with no public proof-of-concept known.

What to do: Upgrade Horde IMP to a release newer than 6.2.27 and Horde Application Framework to a release newer than 5.2.23 as soon as patched versions are published by the Horde project, prioritizing internet-facing webmail servers given the confirmed in-the-wild exploitation. Until patching, consider restricting or disabling rendering of text/html messages and inspect quarantine/mail logs for HTML messages using onerror handlers. Review webmail access and session logs for signs of account takeover and reset credentials for any suspected victims.