CVE-2026-112353：Kerio Connect 10.0.8p2 之前版本存在 SVG 附件儲存 XSS 漏洞
CVE-2026-112353 - GFI KerioConnect < 10.0.8p2 Stored XSS via SVG Attachment
CVE-2026-112353 影響 Kerio Connect 10.0.8p2 之前版本，允許遠端攻擊者透過 SVG 附件執行 JavaScript，進而盜取使用者憑證與信箱內容。
此漏洞已被實際利用，可直接影響使用 Kerio Connect 的企業，提醒即時升級以防止憑證盜取。
GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the Webmail component that allows a remote attacker to run JavaScript in a victim's authenticated Webmail session by uploading a crafted SVG email attachment that bypasses sanitization of event-handler attributes. Attackers can exploit the temporary-download endpoint's insufficient Content-Security-Policy sandbox to execute scripts when the attachment is opened, enabling theft of the victim's credentials and mailbox contents. Proofpoint Threat Research has observed exploitation in the wild as a credential and mailbox stealer.
Impact
Affected Products
The following products are affected by CVE-2026-112353
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 4.0 | MEDIUM | 83251b91-4cc7-4094-a5c7-464a1b83ea10 | ||||
| CVSS 4.0 | MEDIUM | [email protected] |
Update GFI KerioConnect to version 10.0.8 Patch 2 or later to fix the XSS vulnerability.
- Update GFI KerioConnect to 10.0.8 Patch 2 or later.
- Apply vendor-provided patches immediately.
- Sanitize SVG attachments to prevent XSS.
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-112353.
| URL | Resource |
|---|---|
| https://gfi.ai/resource/kerioconnect-product-releases/ | |
| https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2-stored-xss-via-svg-attachment |
雖然 CVE 會識別特定漏洞例項，CWE 則將可能導致漏洞的常見缺陷或弱點分類。CVE-2026-112353 與以下 CWEs 相關：
Common Attack Pattern Enumeration and Classification (CAPEC) 儲存攻擊模式，這些模式描述了對手利用 CVE-2026-112353 弱點時常見的屬性和方法。
我們掃描 GitHub 倉庫以偵測新的概念驗證（PoC）利用方式。以下清單為已於 GitHub 發布的公開利用程式與概念驗證（按最近更新排序）。
由於可能的效能問題，結果僅限前 15 個倉庫。
以下清單列出任何文章中提及 CVE-2026-112353 漏洞的新聞。
以下表格列出隨時間變化對 CVE-2026-112353 漏洞所做的更改。
漏洞歷史細節有助於瞭解漏洞的演變，並識別可能影響其嚴重性、可利用性或其他特徵的最新變更。
-
新 CVE 已接收 由 [email protected]
十月. 27, 2026
動作 型別 舊值 新值 新增 說明 GFI KerioConnect (Kerio Connect) 在 10.0.8 Patch 2 之前包含一個儲存型跨站指令碼漏洞，位於 Webmail 元件，允許遠端攻擊者透過上傳經過精心設計的 SVG 郵件附件，繞過事件處理器屬性的清理，在受害者已驗證的 Webmail 會話中執行 JavaScript。攻擊者可利用 temporary-download 端點缺乏 Content-Security-Policy 沙盒，在附件開啟時執行指令碼，從而竊取受害者的憑證與郵箱內容。Proofpoint Threat Research 已觀察到此漏洞在實際環境中被用作憑證與郵箱竊取工具。 新增 CVSS V4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X 新增 CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N 新增 CWE CWE-79 新增 CWE CWE-83 新增 受影響 收到新的受影響值。 <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/112xxx/CVE-2026-112353.json">CVE-2026-112353</a> 新增 參考 https://gfi.ai/resource/kerioconnect-product-releases/ 新增 參考 https://www.vulncheck.com/advisories/gfi-kerioconnect-8p2-stored-xss-via-svg-attachment
EPSS 是對未來 30 天內觀察到利用活動機率的每日估算。以下圖表顯示該漏洞的 EPSS 分數歷史。