CVE-2025-63499

Targeted Reflected XSS in theme parameter

Researchers: Arseniy Poblaguev, Daniil Khomichenok

Affected Versions <= 5.12.4 ( https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.4 )

Date: 02.12.2025

In the theme parameter there are Reflected XSS Vulnerability:

https://email.victim.com/SOGo/so/[email protected]/Mail/view?theme=%27%3CScRiPt%20%3Ealert%28%27XSS%5FTEST%27%29%3C%2FScRiPt%3E

To successfully exploit the vulnerability, it's necessary to know the potential victim's email address and be able to transmit the payload to that specific victim, it can be done with smtp-user-enum or recon, that so only in this case the vulnerability will be triggered correctly. It's also important to note that the victim must have a valid SOGO session.

Code of theme parameter, which contains injection:

- (NSString *) relativePathToUserFolderSubPath: (NSString *) _sub
{
  NSString *dst, *rel, *theme;

  dst = [[self userFolderPath] stringByAppendingPathComponent: _sub];
  rel = [dst urlPathRelativeToPath:[self ownPath]];

  theme = [[context request] formValueForKey: @"theme"];
  if ([theme length])
    rel = [NSString stringWithFormat: @"%@?theme=%@", rel, theme];

  return rel;
}

Fix: https://github.com/Alinto/sogo/commit/16ab99e7cf8db2c30b211f0d5e338d7f9e3a9efb