SOGo: Incomplete Fix Leaves Further Calendar Invitation Fields Executing Code

The 5.12.10 fix protected only the description, while location, organizer, reply comment and two attribute values of the same card kept executing code.

Advisory ID: TP-2026-082
Product: SOGo (groupware with webmail, calendar and address book)
Vulnerability type: Client-side template injection (CWE-1336)
CVE: requested (MITRE CNA-LR), assignment pending
CVSS 3.1: 9.6 (Critical) · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected versions: <= 5.12.10
Vendor advisory: SOGo 5.12.11 release notes
Fixed in: 5.12.11
Reported: 18 August 2026

Summary

The fix shipped in SOGo 5.12.10 for TP-2026-081 protected only the description block of the invitation card. The remaining fields of the same compiled card stayed open, among them the comment of a reply, the display name of the organizer and the location. On top of that sit the branch that renders an unparsable calendar file verbatim and two places where attacker data is written into attribute values rather than text. The preconditions are the same as before: one mail to the victim is enough and the attacker needs no account on the server. Operators who had installed the 5.12.10 fix remained exploitable.

Root cause

Version 5.12.10 placed ng-non-bindable on exactly one container of the card, the description block (UI/Templates/MailPartViewers/UIxMailPartICalViewer.wox:302), and added a deny list that removes Angular interpolation from the rendered part (UI/MailPartViewers/UIxMailPartICalViewer.m:589 and UI/MailPartViewers/UIxMailPartViewer.m:204). The sibling containers of the same compiled card stayed unprotected, namely the comment of a reply (UIxMailPartICalViewer.wox:241), the display name of the organizer (:254) and the location (:271). When the calendar file cannot be parsed, the template renders its raw content inside a pre block that is compiled as well (UIxMailPartICalViewer.wox:20). Two further places write attacker data into attribute values instead of text, the organizer address into an href (UIxMailPartICalViewer.wox:140 and :150) and the filename of an attachment into a title (UI/Templates/MailPartViewers/UIxMailPartLinkViewer.wox:9 and UI/Templates/MailPartViewers/UIxMailPartImageViewer.wox:13), where a quotation mark in the value ends the attribute early. Version 5.12.11 places ng-non-bindable on every compiled container, escapes comment and description on the server through stringByEscapingHTMLString and strips quotation marks from the filename (UI/MailPartViewers/UIxMailPartViewer.m:343).

Proof of Concept

Content-Type: text/calendar; method=REQUEST

BEGIN:VCALENDAR
BEGIN:VEVENT
SUMMARY:Project update
LOCATION:{{1338*1338}}
END:VEVENT
END:VCALENDAR

-> the opened invitation shows 1790244 in the location field

The location field sits in the same compiled region as the description but carried no ng-non-bindable, so AngularJS keeps evaluating the expression there. The comment of a reply, the display name of the organizer and a deliberately malformed calendar file whose raw content falls into the compiled block reach the same result.

Impact

  • Reading, sending and deleting messages inside the victim's authenticated session, as in TP-2026-081.
  • Continued exposure for operators who had already updated to 5.12.10 and considered the issue closed.
  • Breaking out of an attribute value through a quotation mark in an attachment filename, which needs no calendar invitation but any mail carrying an attachment.
  • Access to every mailbox on the instance if the victim is listed in SOGoSuperUsernames.

References

Is Something Like This in Your Software?

Our team found this vulnerability in the course of its work. Have your applications tested by the same specialists, with a penetration test from turingpoint.

Request a Pentest