CVE-2026-97735 PUBLISHED

Assigner: mitre
Reserved: 25.09.2026 Published: 25.09.2026 Updated: 25.09.2026

ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
CVSS Score: 8

Attack Vector	Network	Scope	Changed
Attack Complexity	High	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	High
User Interaction	Required	Availability Impact	None

CVSS 3.1

Product Status

Vendor	ITFlow
Product	ITFlow
Versions	Default: unaffected affected from 0 to 26.08 (excl.)

References

https://github.com/itflow-org/itflow/security/advisories/GHSA-89fw-w69c-vghj
https://github.com/itflow-org/itflow/commit/16000efcf7f7c833aae9f8da22d2a82df21a49c0

Problem Types

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE