CVE-2019-9858

CVE-2019-9858 describes a remote code execution vulnerability in Horde Groupware Webmail versions 5.2.22 and 5.2.17, stemming from improper handling of image uploads in Horde/Form/Type.php. An attacker can manipulate unsanitized user input in the object[photo][img][file] POST parameter to write arbitrary files, including PHP backdoors, into the web root. This vulnerability carries a CVSS score of 8.8 (High) due to its network-based attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability. While not on the CISA KEV catalog or actively exploited, a Metasploit module exists, indicating readily available exploit code, though community discussion and media coverage are minimal.