The Alinto team is pleased to announce the immediate availability of SOGo v5.12.13. This is a major release as it fixes one security vulnerability.

IMPORTANT

Several vulnerabilities, some critical, have been reported and fixed in this version 5.12.13 or since the nightly of the 4th of November 2026: sogo_5.12.13.20261104.

This vulnerability affects any previous version of SOGo. Please update as soon as possible

CVE ID will be updated once they’re created

• Two SLQ Injections -> fixed
• One buffer overflow -> fixed
• LDAP filter injection -> fixed
• Path traversal -> fixed
• Impersonification -> fixed
• Several unsafe html elements -> fixed

Thanks

Thanks to:

• Benjamin Garo of Waveston for reporting several vulnarabilities
• Richard Olszynský as the finder and VulnCheck as the coordinator for reporting several vulnarabilities
• Faceless0x7 for reporting an SQL injection

Others thing

• timezones: Update to last IANA version 2026f (1b31d4)
• calendar: properly set day mask (46a8ebf)
• draft: check the name of the draft (0b71116)
• ldap: properly escape ldap input (01f545b)
• mail: add missing sorting value (dfbb24b)
• mail: protect tags with unsafe image (d466d9e)
• sql: properly parse name in contact lookup (03ac106)
• sql: properly parse name in contact lookup part 2 (328c96c)
• tool: fix name of subscribe folder by setting the context (8c50b84)
• user: check session key value before using it (868ecbe)

See the complete change log.