GFI KerioConnect: Stored Cross-Site Scripting in Webmail (CVE-2026-112353)

GFI KerioConnect (Kerio Connect) versions prior to 10.0.8 Patch 2 contain a stored cross-site scripting (XSS) vulnerability within the Webmail component. The vulnerability arises from insufficient sanitization of event-handler attributes in SVG email attachments. Exploitation allows remote attackers to execute arbitrary JavaScript in the context of an authenticated victim's session. Proofpoint Threat Research has confirmed in-the-wild exploitation of this vulnerability for credential and mailbox data theft.

Attack Chain

1. Attacker crafts a malicious SVG file containing JavaScript within event-handler attributes.
2. Attacker sends the crafted SVG file as an email attachment to a targeted user.
3. Victim accesses their account via the vulnerable KerioConnect Webmail interface.
4. Victim interacts with or triggers a preview of the malicious email attachment.
5. The KerioConnect temporary-download endpoint serves the SVG content.
6. Due to an insufficient Content-Security-Policy (CSP) sandbox, the embedded JavaScript executes in the victim's browser session.
7. Malicious scripts exfiltrate user credentials or mailbox contents to an attacker-controlled server.

Impact

Confirmed exploitation results in unauthorized credential theft and access to mailbox contents for authenticated users.

Recommendation

Upgrade all GFI KerioConnect installations to version 10.0.8 Patch 2 or later immediately.