CVE-2022-30287: Horde Groupware Webmail reflection injection leads to PHP object deserialization

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityNetwork-reachable deserialization with a public exploit write-up and very high EPSS, though it requires authentication and user interaction and is not in KEV.

What it is

Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack in which an attacker can instantiate a driver class, leading to arbitrary deserialization of PHP objects. Because deserialization of attacker-controlled data can reach dangerous magic methods, this can escalate to remote code execution on the mail server. The flaw matters because webmail is internet-facing and the referenced exploit write-up describes RCE via email.

Impact

An attacker who can trigger the vulnerable path can deserialize arbitrary PHP objects, which can lead to remote code execution and full compromise of the webmail host and its stored mail.

Attack surface

Reached over the network through the webmail application; the CVSS vector requires low privileges (PR:L) and user interaction (UI:R), so an authenticated user must be induced to interact with crafted content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.70651, 99.36th percentile) and a public third-party exploit write-up is referenced, indicating mature public exploitation knowledge.

What to do

• Upgrade Horde Groupware Webmail Edition past 5.2.22 to a fixed release, or apply the Debian LTS security update for the packaged version.
• If immediate patching is not possible, restrict or disable the affected webmail functionality and limit access to trusted networks.
• Enforce least privilege on the webmail service account and isolate the webmail host from other internal systems.
• Monitor vendor and Debian security advisories for follow-up fixes and re-check exposure after each update.

Detection

• Review webmail and PHP logs for unexpected class instantiation or deserialization errors tied to user-supplied input.
• Hunt for suspicious outbound connections or process execution originating from the webmail server.
• Alert on anomalous file writes or new files in webmail application directories.
• Correlate webmail access logs with POST requests containing serialized object patterns or unusual driver-class parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.