Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.1
CVE-2016-6850: Open-Xchange OX App Suite allows malicious SVG profile pictures
CVE-2016-6850 · published 9 years ago
Summary
The suite lets users upload SVG images as profile pictures. If a crafted SVG contains hidden code, that code can run whenever the picture is displayed in a browser, giving an attacker the ability to act as the logged‑in user and potentially steal sessions or perform unwanted actions. Upgrade to the latest release (7.8.2‑rev8 or newer) and restrict or scan SVG uploads until the fix is applied.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| open-xchange | open-xchange_appsuite |
<= 7.8.2 cpe:2.3:a:open-xchange:open-xchange_appsuite:*:rev4:*:*:*:*:*:* |
Original advisory text
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get ex...
An issue was discovered in Open-Xchange OX App Suite before 7.8.2-rev8. SVG files can be used as profile pictures. In case their XML structure contains iframes and script code, that code may get executed when calling the related picture URL or viewing the related person's image within a browser. Malicious script code can be executed within a user's context. This can lead to session hijacking or triggering unwanted actions via the web interface (sending mail, deleting data etc.).
References
- http://www.securityfocus.com/bid/93457 Third Party Advisory VDB Entry
- https://software.open-xchange.com/OX6/6.22/doc/Release_Notes_for_Patch_Release_3... Release Notes Vendor Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published15 Dec 2016
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2016-6850 · NVD
Track software like this
Free during beta