CVE-2026-78061

The CVSS 6.3 on this SSRF in TaxHacker significantly underweights the actual risk. The vulnerability lives in the email sync module where users can specify arbitrary IMAP host and port values — and unlike HTTP-based SSRF that lets attackers probe internal services or pull cloud metadata, this IMAP context creates a genuine data exfiltration vector. A successful attack could transmit stored credentials, session tokens, or email content to an attacker-controlled IMAP endpoint. For a tax preparation tool handling financial data, this exfiltration capability — not port scanning — is what matters. The pending PR status is the critical signal. This vulnerability is live in every deployment running TaxHacker 0.8.2 or earlier. There's no patch to apply, no mitigation release to upgrade to. The PR waiting to merge is your only fix, and pending security PRs in active projects have a troubling history of stagnation, rebase conflicts, or stale closure. The clock on this one is running. The EPSS score of 0.00366 reflects low automated exploitation — there's no public exploit, and the attack surface is narrow. But EPSS models commodity threat actors, not targeted ones. TaxHacker processes sensitive financial information. Financially motivated attackers who know specific deployments exist would find this SSRF valuable precisely because it's unpatched and low-noise. The IMAP connection can authenticate and interact, not just probe; it's a bridge from a trusted system into attacker-controlled infrastructure. Verify whether email sync is enabled in your deployment, check what credentials are stored for IMAP connections (OAuth tokens, app passwords, or basic auth), and treat the unmerged PR as a de facto zero-day until it lands. If the fix uses blocklist-based filtering rather than allowlist validation, treat the patched version as a temporary measure and plan for proper input validation.

Reviewed through automated stages and approved by a human before publication.