Hello,
we found a reproducible rendering issue in SOGo with multipart/related
messages.
We encountered the problem on a mail coming from a customer using some
microsoft mail. Whole mail was not readable in SOGo.
Environment:
mailcow 2026-07a
SOGo version bundled with mailcow 2026-07a
Browsers tested: Firefox / Chromium
Control client: Mozilla Thunderbird
Problem:
SOGo renders a non-root text/html MIME part with
Content-Disposition: inline
inside a multipart/related message as additional visible message body
content.
The same message is displayed correctly in Thunderbird.
Minimal MIME structure:
multipart/related; type="multipart/alternative"
|
+-- multipart/alternative <-- root object
| |
| +-- text/plain
| |
| +-- text/html <-- actual message body
|
+-- text/html <-- related non-root part
Content-ID: <test-html-resource>
Content-Disposition: inline
There is no "start" parameter on the outer multipart/related, therefore
the first body part (multipart/alternative) is the root object.
Actual behavior in SOGo:
SOGo displays both
the normal HTML message body, and
the additional related text/html part below the message.
If the related HTML part contains CSS such as position, z-index or large
backgrounds, this can severely break the message display.
Expected behavior:
Only the root object of multipart/related should be displayed as the
message body.
Non-root related MIME parts should not automatically be rendered as
additional message body content.
Thunderbird behavior:
Thunderbird displays only the actual root HTML message. The additional
inline text/html related part is not appended to the visible message body.
A/B tests:
Test A:
additional related text/html part
Content-Disposition: inline
no CID reference from the root HTML
Result:
SOGo: incorrect, related HTML is still rendered below the message
Thunderbird: correct
This shows that a CID reference is not required to trigger the issue.
Test B:
Same structure, but:
Content-Disposition: attachment
Result:
SOGo: correct, the HTML part is shown as an attachment
Thunderbird: correct
This indicates that Content-Disposition: inline is an important part of
the trigger.
We initially found this with a real customer email. Removing only the
additional related text/html MIME part caused the original message to
render correctly in SOGo.
I have attached a fully synthetic .eml reproducer.
The attached reproducer is:
sogo_ab_A_no_cid_reference.eml
It contains the minimal case where the related HTML part is not
referenced by the root HTML at all.
Please let me know if you need any additional information or further
test cases.
Best regards
Felix
--- Begin Message ---
SOGo A/B reproduction test.
This message contains an additional related text/html MIME part.
RELATED text/html MIME part - A/B test
--- End Message ---
