Live › vulnerability › CVE-2026-113583
Go to dashboardCypht webmail versions 2.0.0 through 2.12.2 build a blocked-image notice with innerHTML from values taken out of an HTML email. A crafted email can make the victim's browser run attacker JavaScript inside their logged-in session, which can read mail, send mail, or change settings.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Cypht webmail installs in the affected range are exposed when a user opens an HTML email, and the exposure needs ALLOW_EXTERNAL_IMAGE_SOURCES to be enabled. The sources say the attacker only needs to send the email, so any deployment that receives mail from outside is in scope when the setting is on. Installs with external image sources disabled are described as not triggering the flaw, but the sources do not confirm this.
No product ranges from the sources yet.
2.0.0 through 2.12.2.ALLOW_EXTERNAL_IMAGE_SOURCES is enabled in the Cypht configuration.2.12.2; the sources do not name the fixed version.ALLOW_EXTERNAL_IMAGE_SOURCES disabled; the sources do not say whether that fully blocks the flaw.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
This page as .md · .json · in your agent: get_signal("CVE-2026-113583")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.