search menu icon-carat-right cmu-wordmark

CERT Coordination Center

Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Vulnerability Note VU#487613

Original Release Date: 2026-08-06 | Last Revised: 2026-08-06

Overview

A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings.

Description

Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure.

CVE-2026-8496
The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as <animate onrepeat='...'>, with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This occurs during normal calendar view rendering (e.g., when a user opens or previews the calendar tab), even without explicit interaction.

Impact

Once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting the attacker full read access to the victim's mailbox. This enables:
Credential theft through forced logout/login phishing
Password manager autofill hijacking
Full exfiltration of email messages, folder contents, and metadata
Extraction of contact lists and calendar data

Solution

Users are recommended to upgrade to SOGo v5.12.8 or newer. v5.12.8 addresses this issue via sanitizing ICS DESCRIPTION content and stricter handling of embedded SVG and HTML.

Acknowledgements

Thank you to Greg Lesnewich for reporting this issue. This AI-assisted vulnerability note was prepared by Alexander Curtis.

Vendor Information

487613
 

Alinto SOGo Unknown

Notified:  2026-05-26 Updated: 2026-08-06

CVE-2026-8496 Unknown

Vendor Statement

We have not received a statement from the vendor.


Other Information

CVE IDs: CVE-2026-8496
API URL: VINCE JSON | CSAF
Date Public: 2026-08-06
Date First Published: 2026-08-06
Date Last Updated: 2026-08-06 18:36 UTC
Document Revision: 1

Sponsored by CISA.