News, updates, trends and the latest
info you need to know about IT

Critical hardening steps for water, power, and municipal utilities.

Overview
A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings.
Description
Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure.
CVE-2026-8496
The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as <animate onrepeat=’…’>, with JavaScript event handlers, the browser executes the script in the context of the SOGo webmail interface. This occurs during normal calendar view rendering (e.g., when a user opens or previews the calendar tab), even without explicit interaction.
Impact
Once an attacker delivers a malicious ICS file via email, any user who views the calendar will execute the embedded XSS payload, granting the attacker full read access to the victim’s mailbox. This enables:
Credential theft through forced logout/login phishing
Password manager autofill hijacking
Full exfiltration of email messages, folder contents, and metadata
Extraction of contact lists and calendar data
Solution
Users are recommended to upgrade to SOGo v5.12.8 or newer. v5.12.8 addresses this issue via sanitizing ICS DESCRIPTION content and stricter handling of embedded SVG and HTML.
Acknowledgements
Thank you to Greg Lesnewich for reporting this issue. This AI-assisted vulnerability note was prepared by Alexander Curtis.

Overview
VPS.org’s one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures.
Description
VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time.
CVE-2026-16503 The Supabase template provides an instance of PostgreSQL that is bound to all network interfaces (0.0.0.0:5432) and uses the hard-coded database password postgres. Because Docker manages its own iptables rules, this exposure can bypass standard host UFW firewall configurations. If the the instance is exposed to the internet, a remote attacker could connect to the host’s published TCP port 5432 and authenticate as the postgres superuser account using the default postgres password.
CVE-2026-16504 The Zulip template ships with a hard-coded application key secret_key: changeme, a default database password zulip, and the setting DISABLE_HTTPS=True. An attacker can use this public secret key to forge or validate signed session material, enabling session forgery and authentication bypass against the instance. If unchanged, the default database password zulip can be used to authenticate to the database. Furthermore, the DISABLE_HTTPS=True configuration causes all traffic to be sent over unencrypted HTTP by default, exposing credentials and session data to potential interception in certain deployments.
Impact
CVE-2026-16503 (Supabase template): PostgreSQL superuser access from the internet enables the following:
* read and exfiltrate data
* insert/modify/delete data
* alter the database schema, roles, and privileges
* establish persistence via database objects
* denial of service through destructive statements (dropping tables/databases)
CVE-2026-16504 (Zulip template): Authentication bypass and session forgery allows the following:
* account and instance takeover
* interception of credentials and session tokens over unencrypted transport
This constitutes a Technical Impact = Total under the SSVC framework, meaning:

The vulnerability gives the adversary total control over the behavior of the software or total disclosure of all information on the affected system.

Solution
Unfortunately, VPS.org could not be reached to coordinate these vulnerabilities, and a patch is not yet available. Users of VPS.org one-click deployment templates are advised to change any default passwords and secret keys before deploying to a production environment. Firewall rules and network segmentation should be implemented to restrict internet access to back-end systems such as databases and other sensitive resources. Finally, where applicable, HTTPS should be enabled to protect credentials and session data in transit.
Acknowledgements
Thank you to Simon Gajdosik for reporting these vulnerabilities. This document was written by Bob Kemerer.