A cross-site scripting vulnerability has been discovered in Alinto SOGo version 5.12.7. This flaw allows remote code execution by embedding malicious SVG objects within ICS calendar invitations. The vulnerability is actively being exploited in real-world attacks, as evidenced by its appearance on VirusTotal. Alinto SOGo is an open-source webmail and groupware platform used by organizations to manage email, calendars, contacts, and scheduling. The vulnerability stems from SOGo's improper handling of the DESCRIPTION field within ICS files. This field is rendered without adequate sanitization or Content Security Policy enforcement. When a calendar invite includes an SVG payload with JavaScript event handlers, the browser executes the script within the SOGo webmail context. This script execution happens automatically when a user views the calendar, even without direct interaction. The impact of this vulnerability is significant, providing attackers with full read access to a victim's mailbox. This can lead to credential theft via phishing, hijacking of password manager autofill, and exfiltration of all email content and metadata. Attackers can also extract contact lists and calendar data. Users are strongly advised to upgrade to SOGo version 5.12.8 or a later version. This newer version fixes the vulnerability by sanitizing ICS DESCRIPTION content and enforcing stricter handling of embedded SVG and HTML.