View Issue Details

IDProjectCategoryView StatusLast Update
0006240SOGoGUIpublic2026-08-27 11:45
Reportergonzo Assigned To 
PrioritynormalSeverityminorReproducibilityalways
Status newResolutionopen 
Platform[Server] LinuxOSUbuntuOS Version16.04 LTS
Product Version5.12.10 
Summary0006240: non-root inline text/html part in multipart/related is rendered as message body
Description

Problem:
SOGo renders a non-root text/html MIME part with

Content-Disposition: inline

inside a multipart/related message as additional visible message body content.

The same message is displayed correctly in Thunderbird.

Minimal MIME structure:

multipart/related; type="multipart/alternative" +-- multipart/alternative <-- root object
+-- text/plain
+-- text/html <-- actual message body

+-- text/html <-- related non-root part
Content-ID: <test-html-resource>
Content-Disposition: inline

There is no "start" parameter on the outer multipart/related, therefore the first body part (multipart/alternative) is the root object.

Actual behavior in SOGo:
SOGo displays both

the normal HTML message body, and
the additional related text/html part below the message.

If the related HTML part contains CSS such as position, z-index or large backgrounds, this can severely break the message display.

Expected behavior:
Only the root object of multipart/related should be displayed as the message body.

Non-root related MIME parts should not automatically be rendered as additional message body content.

Thunderbird behavior:
Thunderbird displays only the actual root HTML message. The additional inline text/html related part is not appended to the visible message body.

Steps To Reproduce

A/B tests:

Test A:

additional related text/html part
Content-Disposition: inline
no CID reference from the root HTML

Result:

SOGo: incorrect, related HTML is still rendered below the message
Thunderbird: correct

This shows that a CID reference is not required to trigger the issue.

Test B:
Same structure, but:

Content-Disposition: attachment

Result:

SOGo: correct, the HTML part is shown as an attachment
Thunderbird: correct

This indicates that Content-Disposition: inline is an important part of the trigger.

We initially found this with a real customer email. Removing only the additional related text/html MIME part caused the original message to render correctly in SOGo.

I have attached a fully synthetic .eml reproducer.

The attached reproducer is:

sogo_ab_A_no_cid_reference.eml

It contains the minimal case where the related HTML part is not referenced by the root HTML at all.

Please let me know if you need any additional information or further test cases.

Additional Information

Environment:

mailcow 2026-07a
SOGo version bundled with mailcow 2026-07a
Browsers tested: Firefox / Chromium
Control client: Mozilla Thunderbird

Tagscas, html, rendering

Activities

gonzo

gonzo

2026-08-27 11:45

reporter  

Issue History

Date Modified Username Field Change
2026-08-27 11:45 gonzo New Issue
2026-08-27 11:45 gonzo Tag Attached: cas
2026-08-27 11:45 gonzo Tag Attached: html
2026-08-27 11:45 gonzo Tag Attached: rendering
2026-08-27 11:45 gonzo File Added: sogo_ab_A_no_cid_reference.eml