CVE catalog

CVE-2021-26929

php-horde-text-filter: CVE-2021-26929

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
4.94% · Oct 25, 2026

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianphp-horde-text-filtersid2.3.7-1fixed
Debianphp-horde-text-filterbookworm2.3.7-1fixed
Ubuntuphp-horde-text-filter16.042.3.2-1vulnerable
Ubuntuphp-horde-text-filter16.042.3.2-2vulnerable
Ubuntuphp-horde-text-filter16.042.3.3-1vulnerable
Ubuntuphp-horde-text-filter16.042.3.3-1ubuntu1vulnerable
Ubuntuphp-horde-text-filter18.042.3.5-1vulnerable
Ubuntuphp-horde-text-filter18.042.3.5-1ubuntu1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianphp-horde-text-filtersourcesid2.3.7-1not yet assignedNot reported[982769]
Debianphp-horde-text-filtersourcebookworm2.3.7-1not yet assignedNot reported[982769]

[Debian bug #982769]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [php-horde-text-filter]Fixed
    Details (2)

    • 2.3.7-1 · all · bookworm

      Fixed · Fixed: 2.3.7-1

      dsa · php-horde-text-filter · debian · bookworm; dsa · php-horde-text-filter · debian · 12

    • 2.3.7-1 · all · bookworm

      Fixed · Fixed: 2.3.7-1

      dsa · php-horde-text-filter · debian · bookworm; dsa · php-horde-text-filter · debian · 12

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]