What is CVE-2023-26430?

CVE-2023-26430 is a low-severity vulnerability in Open-Xchange Appsuite Backend, classified under Command Injection. CVSS score: 3.5/10. Published 2023-08-02.

How severe is CVE-2023-26430?

Low severity. CVSS v3 base score is 3.5 out of 10.

Is CVE-2023-26430 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

RCE in Open-Xchange Appsuite Backend

CVE-2023-26430

Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. This could be abused to access SIEVE extension that are not allowed by App Suite or to inject rules which would break per-user filter processing, requiring manual cleanup of such rules. We have added sanitization to all mail-filter APIs to avoid forwardning control characters to subsystems. No publicly available exploits are known.

Vulnerability class: Command Injection (OS Command Injection)

Published 2023-08-02 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.008 (53.2th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 53rd percentile — 53.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Open-Xchange Appsuite Backend — versions 7.10.6, 8.10.0
Ox Software Gmbh App Suite — versions 0

Weakness classification (CWE)

CWE-77 — Command Injection

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

software.open-xchange.com/products/appsuite/doc/Release_Notes_for_Patch_Release… (release-notes, Release Notes)
documentation.open-xchange.com/appsuite/security/advisories/csaf/2023/oxas-adv-… (vendor-advisory)
seclists.org/fulldisclosure/2023/Aug/8 (Mailing List, Third Party Advisory)
packetstormsecurity.com/files/173943/OX-App-Suite-SSRF-SQL-Injection-Cross-Site… (VDB Entry, Third Party Advisory)

Frequently asked questions

What is CVE-2023-26430?: CVE-2023-26430 is a low-severity vulnerability in Open-Xchange Appsuite Backend, classified under Command Injection. CVSS score: 3.5/10. Published 2023-08-02.
How severe is CVE-2023-26430?: Low severity. CVSS v3 base score is 3.5 out of 10.
Is CVE-2023-26430 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.