{"id":"CVE-2026-112353","kind":"vulnerability","aliases":["CVE-2026-112353"],"related":[],"title":"Kerio Connect Webmail: stored XSS via SVG attachment steals sessions","description":"GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.","summary":"Kerio Connect before 10.0.8 Patch 2 lets a remote attacker upload an SVG email attachment with event-handler code that bypasses sanitization. When a victim opens the attachment, the script runs in their authenticated Webmail session and can steal credentials and mailbox contents.","severity":"high","cvss":8.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","kerio-connect","package","self-hosted","webmail"],"not_affected_if":["patched-version"],"how_to_check":"- Check the installed Kerio Connect version in the admin console or on the server; versions before `10.0.8 Patch 2` are affected\n- unknown","fix":"- Upgrade Kerio Connect to `10.0.8 Patch 2` or later\n- Until patched, unknown","status":"open","published_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:29+00:00","updated_at":"2026-10-27T17:34:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T17:34:29Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Kerio Connect to `10.0.8 Patch 2` or later\n- Until patched, unknown","reach":"internet","title":"Kerio Connect Webmail: stored XSS via SVG attachment steals sessions","impact":"high","summary":"Kerio Connect before 10.0.8 Patch 2 lets a remote attacker upload an SVG email attachment with event-handler code that bypasses sanitization. When a victim opens the attachment, the script runs in their authenticated Webmail session and can steal credentials and mailbox contents.","category":"package","nicknames":[],"who_cares":["kerio-connect","webmail","email","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker steals victim's Webmail credentials and mailbox contents","analyst_note":"Exploitation in the wild is reported by Proofpoint Threat Research; find their write-up for IOCs and the exact mitigation or workaround before the patch.","how_to_check":"- Check the installed Kerio Connect version in the admin console or on the server; versions before `10.0.8 Patch 2` are affected\n- unknown","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Organizations running Kerio Connect Webmail before 10.0.8 Patch 2 are exposed, because any user who opens a crafted SVG attachment can have their session abused. Teams on newer patched releases or not running Kerio Connect can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000622,"input_tokens":3457,"output_tokens":553,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-112353':13A,16A '-2026':12A,15A '10.0.8':29B,75C '2':31B,77C 'allow':91C 'attach':8A,40B,54B,111C,140C 'attack':35B,94C,120C 'attribut':119C 'authent':60B,102C 'bypass':47B,113C 'code':45B 'compon':89C 'connect':2A,20B,27B,73C 'contain':78C 'content':69B,131C,152C 'content-security-polici':130C 'craft':108C 'credenti':66B,149C,164C 'cross':82C 'cross-sit':81C 'cve':11A,14A 'download':126C 'email':17B,39B,110C 'enabl':143C 'endpoint':127C 'event':43B,117C 'event-handl':42B,116C 'execut':136C 'exploit':122C,158C 'gfi':70C 'handler':44B,118C 'host':24B 'insuffici':129C 'javascript':97C 'kerio':1A,19B,26B,72C 'kerio-connect':18B 'kerioconnect':71C 'let':32B 'mailbox':68B,151C,166C 'observ':157C 'open':52B,142C 'packag':21B 'patch':30B,76C 'polici':133C 'proofpoint':153C 'remot':34B,93C 'research':155C 'run':57B,96C 'sandbox':134C 'sanit':48B,114C 'script':56B,84C,137C 'secur':132C 'self':23B 'self-host':22B 'session':10A,62B,104C 'site':83C 'steal':9A,65B 'stealer':167C 'store':4A,80C 'svg':7A,38B,109C 'temporari':125C 'temporary-download':124C 'theft':144C 'threat':154C 'upload':36B,106C 'via':6A 'victim':51B,100C,147C 'vulner':85C 'webmail':3A,25B,61B,88C,103C 'wild':161C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Organizations running Kerio Connect Webmail before 10.0.8 Patch 2 are exposed, because any user who opens a crafted SVG attachment can have their session abused. Teams on newer patched releases or not running Kerio Connect can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:58+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112353","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112353","severity":null,"published_at":"2026-10-27T17:16:58+00:00","modified_at":"2026-10-27T17:16:58+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}