CVE-2026-127135

EUVD-2026-124532

12.11.2026, 16:19

SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary Sieve directives by inserting unescaped notification address values into a generated Sieve script. Attackers can embed Sieve redirect or discard statements within the notificationAddress preference to bypass the administrator-configured forwarding-domain constraint and redirect or discard incoming mail.

Static Code Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
VulnCheck	CNA	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Early Detection

Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).

Vendor	Product	Version	Source
alinto	sogo	𝑥 < 5.12.13	CNA

Debian Releases

Debian Product

Codename

sogo

bookworm	vulnerable
bookworm (security)	vulnerable
sid	5.12.13-1 fixed
trixie	vulnerable
trixie (security)	vulnerable

Common Weakness Enumeration

CWE-96 - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input into an executable resource, such as a library, configuration file, or template.

References

https://github.com/Alinto/sogo/releases/tag/SOGo-5.12.13

https://www.vulncheck.com/advisories/sogo-before-sieve-script-injection-via-notification-address