VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Alinto SOGo versions prior to 5.12.8 have a cross-site scripting vulnerability in how the product processes ICS (iCalendar) invitations, enabling remote code execution through embedded malicious SVG content. The highest-level impact described is that a victim who views the calendar can have an XSS payload executed in the SOGo webmail interface.

The issue is identified as CVE-2026-8496. The vulnerability is in SOGo handling of ICS files, specifically rendering the DESCRIPTION field without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This execution occurs during normal calendar view rendering, such as when a user opens or previews the calendar tab, and it can happen without explicit interaction.

The advisory describes that once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting full read access to the victim's mailbox. The document lists credential theft through forced logout/login phishing, password manager autofill hijacking, full exfiltration of email messages, folder contents, and metadata, and extraction of contact lists and calendar data.

Users are recommended to upgrade to SOGo v5.12.8 or newer. The advisory states that v5.12.8 addresses the issue by sanitizing ICS DESCRIPTION content and by applying stricter handling of embedded SVG and HTML.

The guidance section of the advisory directs users to upgrade to SOGo v5.12.8 or newer. It also includes acknowledgements thanking Greg Lesnewich for reporting the issue and noting that the vulnerability note was prepared by Alexander Curtis.