CyberRota Analysis
AI-GeneratedITFlow prior to version 26.08 is vulnerable to a high-severity issue that permits the processing of SVG attachments in its ticket email parser, potentially allowing arbitrary code execution from malicious emails received via SMTP. Organizations using this software should prioritize patching to mitigate the risk of exploitation, as attackers could leverage this vulnerability to execute harmful scripts on affected systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
ITFlow before 26.08 allows SVG attachments in the ticket email parser (cron/ticket_email_parser.php) for email messages that may arrive over SMTP from arbitrary senders.