CVE-2026-8496 — Cross-Site Scripting (XSS)

title: CVE-2026-8496 - Alinto SOGo ICS XSS via SVG onrepeat
id: scw-2026-05-13-ai-1
status: experimental
level: high
description: |
  Detects the specific pattern of an ICS calendar invitation file being processed by Alinto SOGo that contains embedded SVG with an 'onrepeat' event handler in the description, indicative of CVE-2026-8496. This vulnerability allows arbitrary JavaScript execution within the authenticated SOGo webmail session.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-8496/
tags:
  - attack.initial_access
  - attack.t1189
logsource:
    category: email
detection:
  selection:
      uri|contains:
          - '/SOGo/'
      cs-uri-query|contains:
          - 'text/calendar'
      cs-uri-query|contains:
          - 'BEGIN:VCALENDAR'
      cs-uri-query|contains:
          - 'BEGIN:VEVENT'
      cs-uri-query|contains:
          - 'DESCRIPTION:'
      cs-uri-query|contains:
          - 'svg'
      cs-uri-query|contains:
          - 'onload='
      cs-uri-query|contains:
          - 'onrepeat='
      condition: selection
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse