CVE-2020-8865: 
Linux Debian vulnerability analysis and mitigation

CVE-2020-8865 is a directory traversal vulnerability discovered in Horde Groupware Webmail Edition 5.2.22. The vulnerability was disclosed on March 10, 2020, with a CVSS score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). This security flaw affects the Horde Application Framework and requires authentication to exploit (ZDI Advisory).

The vulnerability exists within edit.php when parsing the params[template] parameter. The process does not properly validate a user-supplied path prior to using it in file operations. This insufficient input sanitization in the Horde Application Framework allows authenticated remote attackers to execute local PHP files on affected installations (ZDI Advisory).

If successfully exploited, this vulnerability allows attackers to execute code in the context of the www-data user when leveraged in conjunction with other vulnerabilities. The impact is reflected in the CVSS metrics showing potential compromise of confidentiality, integrity, and availability, all rated as Low (ZDI Advisory).

Horde has released an update to address this vulnerability. For Debian 8 'Jessie' users, the fix is available in version 1.1.1-2+deb8u1 of the php-horde-trean package (Debian Advisory).