What’s Vulnerable › Vulnerabilities
CVE-2020-8518
- Severity: critical (CVSS 9.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 71.7% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2020-02-17 · updated 2026-06-17
- Weakness: CWE-94
Description
Horde Groupware Webmail Edition 5.2.22 allows injection of arbitrary PHP code via CSV data, leading to remote code execution.
Affected products
- Debian Linux: 8.0
- Fedoraproject Fedora: 30, 31
- Horde Groupware: 5.2.22
References
- http://packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.html
- https://lists.debian.org/debian-lts-announce/2020/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PRPIFQDGYPQ3F2TF2ETPIL7IYNSVVZQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T/
- https://lists.horde.org/archives/announce/2020/001285.html
- http://packetstormsecurity.com/files/156872/Horde-5.2.22-CSV-Import-Code-Execution.html
- https://lists.debian.org/debian-lts-announce/2020/04/msg00008.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2PRPIFQDGYPQ3F2TF2ETPIL7IYNSVVZQ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKTNYDBDVJNMVC7QPXQI7CMPLX3USZ2T/
- https://lists.horde.org/archives/announce/2020/001285.html
Get alerted when CVE-2020-8518 or the next vulnerability affects your stack