EIP-2026-107616

PRE-CVE

Horde Imp - 'imap_open' Remote Command Execution

Title source: legacy
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for EIP-2026-107616. PoCs published by Paolo Serracino_ Pietro Minniti_ Damiano Proietti.

AI-analyzed exploit summary This exploit targets Horde Imp's unauthenticated debug page (`test.php`) to achieve remote command execution via the `imap_open` function. It leverages CVE-2018-19518 by injecting a malicious IMAP server string with a `ProxyCommand` payload.

Description

Horde Imp - 'imap_open' Remote Command Execution

Exploits (1)

exploitdb WORKING POC
by Paolo Serracino_ Pietro Minniti_ Damiano Proietti · pythonwebappsphp
https://www.exploit-db.com/exploits/46136

This exploit targets Horde Imp's unauthenticated debug page (`test.php`) to achieve remote command execution via the `imap_open` function. It leverages CVE-2018-19518 by injecting a malicious IMAP server string with a `ProxyCommand` payload.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Horde Imp (all versions)
No auth needed
Prerequisites: Exposed `/imp/test.php` debug page · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Details

Status pre_cve
Tracked Since Feb 18, 2026