# CVE-2026-65053 - Horde IMP AppleDouble MIME viewer (lib/Mime/Viewer/Appledouble.php) writes
# the data part's name parameter into an HTML status block without escaping, so a
# multipart/appledouble message whose data part carries markup in its name parameter yields
# stored XSS when any user views the message. The attack vector is a crafted email, so detect
# the malicious MIME shape (multipart/appledouble with an XSS payload in the name parameter)
# in the SMTP stream.
alert smtp $EXTERNAL_NET any -> $HOME_NET any (msg:"VEDAS CVE-2026-65053 Horde IMP AppleDouble MIME Name Stored XSS (crafted email)"; flow:established,to_server; file.data; content:"multipart/appledouble"; nocase; fast_pattern; content:"name"; nocase; distance:0; pcre:"/name\s*=\s*\x22?[^\x22\r\n]{0,200}(?:<|%3c)\s*(?:script|svg|img|iframe|body|details|a\b|on[a-z]+\s*=)/i"; classtype:web-application-attack; reference:cve,CVE-2026-65053; reference:url,https://www.exploit.observer/?keyword=CVE-2026-65053&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=horde&match=exact; sid:1099005; rev:1;)