CVE-2021-26929

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the...

6.1 MediumPublic exploitFix available

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the Horde_Text_Filter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

4.94%Up 3.6 points since Apr 14, 2021

What each source reports

NVD Score used 6.1

Record: CVE-2021-26929
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0: 4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness: CWE-79
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-26929
Updated: 2026-11-02

EUVDEUVD-2021-13711 No score

Record: EUVD-2021-13711
Updated: 2026-11-03

GitHub AdvisoriesGHSA-qc5g-54hm-vfmc 6.1

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the...

Record: GHSA-qc5g-54hm-vfmc
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 6.1

Record: CVE-2021-26929
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVDEBIAN-CVE-2021-26929 6.1

Record: DEBIAN-CVE-2021-26929
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVUBUNTU-CVE-2021-26929 6.1

Record: UBUNTU-CVE-2021-26929
CVSS 3.1: 6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`php-horde-text-filter` Debian:12	before 2.3.7-1	2.3.7-1
`php-horde-text-filter` Debian:9	before 2.3.5-1+deb9u1, plus listed versions 2.3.5-1	2.3.5-1+deb9u1
`php-horde-text-filter` Ubuntu:16.04:LTS	All versions, plus listed versions 2.3.2-12.3.2-22.3.3-12.3.3-1ubuntu1	None known
`php-horde-text-filter` Ubuntu:18.04:LTS	All versions, plus listed versions 2.3.5-12.3.5-1ubuntu1	None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Horde Groupware Webmail 5.2.22 - Stored XSS	2021-04-15

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-26929 is a medium vulnerability (CVSS 6.1) in Horde Groupware, published February 14, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 4.94%, the 92nd percentile. Fixed in php-horde-text-filter 2.3.7-1.

References

Show 8 moreShow less