CVE-2026-78061 | vas3k TaxHacker up to 0.8.2 Email Sync imap-client.ts buildImapConfig host/port server-side request forgery (Issue 148)

August 22, 2026 Yanac

A vulnerability was found in vas3k TaxHacker up to 0.8.2 and classified as critical. Impacted is the function buildImapConfig of the file lib/email-sync/imap-client.ts of the component Email Sync. Executing a manipulation of the argument host/port can lead to server-side request forgery.

This vulnerability is registered as CVE-2026-78061. It is possible to launch the attack remotely. No exploit is available.

The pull request to fix this issue awaits acceptance.VulDB Recent EntriesRead More