Hi,

The following vulnerability was published for php-horde-imp.

CVE-2026-58451[0]:
| Horde IMP before 7.0.1 contains a path traversal vulnerability in
| lib/Compose.php that allows authenticated attackers to read
| arbitrary files from the server filesystem by embedding traversal
| sequences after a CKEditor path prefix in img src URLs. Attackers
| can bypass the stripos() prefix validation by appending sequences
| such as traversal segments after the matching prefix, causing
| file_get_contents() to read sensitive files whose contents are then
| exfiltrated as MIME parts in outgoing email; unauthenticated
| exploitation is also achievable via CSRF against an active
| authenticated session.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-58451
https://www.cve.org/CVERecord?id=CVE-2026-58451
[1] https://github.com/horde/imp/pull/85
[2] https://github.com/horde/imp/commit/fba972fab72ee6871e5d56e6390bee38593085de

Regards,
Salvatore