CVE-2026-113583
CVE-2026-113583 · Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
CVSS 5.3 · Media · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
cypht
- Versiones
- ≥ 2.0.0, < 2.13.0: Afectada (semver)
Actualiza a 2.13.0