CVE-2026-97735

Severity: high (CVSS 8.0 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-25 · updated 2026-09-30
Weakness: CWE-79

Description

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

Affected products

ITFlow: before 26.08 — fixed in 26.08

How to fix

Upgrade to a fixed version: ITFlow 26.08. Check the vendor advisory for mitigations.

References

https://github.com/itflow-org/itflow/commit/16000efcf7f7c833aae9f8da22d2a82df21a49c0
https://github.com/itflow-org/itflow/security/advisories/GHSA-89fw-w69c-vghj

Get alerted when CVE-2026-97735 or the next vulnerability affects your stack