---
id: CVE-2026-112356
title: GFI KerioConnect < 10.0.9p2 XSS via Link Auto-Formatter
summary: >-
  GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site
  scripting vulnerability in the Webmail component that allows a remote attacker
  to spoof link targets or inject HTML into a message as rendered in a victim's
  aut…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
  - CWE-83
vendor: 'GFI USA, LLC'
product: GFI KerioConnect
affected:
  - gfi_kerioconnect < 10.0.9p2
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-28T16:00:53.744697Z'
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:03:52.733Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-112356'
references:
  - url: 'https://gfi.ai/resource/kerioconnect-product-releases/'
    label: Release Notes
  - url: >-
      https://www.vulncheck.com/advisories/gfi-kerioconnect-9p2-xss-via-link-auto-formatter
    label: >-
      VulnCheck Advisory: GFI KerioConnect < 10.0.9p2 HTML Injection via Link
      Auto-Formatter
tags:
  - cve.org
ingestedAt: '2026-10-28T16:13:50.585Z'
---

## Overview

GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail component that allows a remote attacker to spoof link targets or inject HTML into a message as rendered in a victim's authenticated Webmail session by sending a crafted email whose text is already inside a link. Attackers can exploit the link auto-formatter's re-processing of already-linked text, using quote characters to break out of the href attribute and inject attacker-controlled markup to execute script in the victim's session.

## Affected

- `gfi_kerioconnect < 10.0.9p2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.