{"id":"CVE-2026-113583","kind":"vulnerability","aliases":["CVE-2026-113583"],"related":[],"title":"Cypht webmail: crafted email image alt text runs script in session","description":"Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.","summary":"Cypht webmail versions 2.0.0 through 2.12.2 build a blocked-image notice with innerHTML from values taken out of an HTML email. A crafted email can make the victim's browser run attacker JavaScript inside their logged-in session, which can read mail, send mail, or change settings.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cypht","package","self-hosted","webmail"],"not_affected_if":["default-config","external-images-disabled"],"how_to_check":"- Check the installed Cypht version in the deployment's release or package metadata, looking for versions from `2.0.0` through `2.12.2`.\n- Check whether `ALLOW_EXTERNAL_IMAGE_SOURCES` is enabled in the Cypht configuration.","fix":"- Upgrade Cypht to a release newer than `2.12.2`; the sources do not name the fixed version.\n- Until patched, leave `ALLOW_EXTERNAL_IMAGE_SOURCES` disabled; the sources do not say whether that fully blocks the flaw.","status":"open","published_at":"2026-10-20T12:17:29+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:04:13+00:00","updated_at":"2026-10-25T04:04:13+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:04:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Cypht to a release newer than `2.12.2`; the sources do not name the fixed version.\n- Until patched, leave `ALLOW_EXTERNAL_IMAGE_SOURCES` disabled; the sources do not say whether that fully blocks the flaw.","reach":"internet","title":"Cypht webmail: crafted email image alt text runs script in session","impact":"high","summary":"Cypht webmail versions 2.0.0 through 2.12.2 build a blocked-image notice with innerHTML from values taken out of an HTML email. A crafted email can make the victim's browser run attacker JavaScript inside their logged-in session, which can read mail, send mail, or change settings.","category":"package","nicknames":[],"who_cares":["cypht","webmail","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker script runs in victim's session, reading and sending mail","analyst_note":"Confirm the fixed version and whether disabling ALLOW_EXTERNAL_IMAGE_SOURCES fully blocks the flaw; check the Cypht project release notes.","how_to_check":"- Check the installed Cypht version in the deployment's release or package metadata, looking for versions from `2.0.0` through `2.12.2`.\n- Check whether `ALLOW_EXTERNAL_IMAGE_SOURCES` is enabled in the Cypht configuration.","needs_analyst":true,"not_affected_if":["default-config","external-images-disabled"],"who_is_affected":"Cypht webmail installs in the affected range are exposed when a user opens an HTML email, and the exposure needs ALLOW_EXTERNAL_IMAGE_SOURCES to be enabled. The sources say the attacker only needs to send the email, so any deployment that receives mail from outside is in scope when the setting is on. Installs with external image sources disabled are described as not triggering the flaw, but the sources do not confirm this.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":3436,"output_tokens":713,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113583':14A,17A '-2026':13A,16A '2.0.0':27B,75C '2.12.2':29B,77C 'allow':89C,113C 'alt':6A,99C 'arbitrari':94C 'attack':56B,91C,119C 'authent':157C 'base':82C 'block':33B,139C 'blocked-imag':32B,138C 'browser':54B 'build':30B,136C 'chang':71B,165C 'code':135C 'contain':78C 'craft':3A,47B,97C,124C 'cross':84C 'cross-sit':83C 'cve':12A,15A 'cypht':1A,18B,24B,73C 'decod':145C 'deriv':148C 'dom':81C 'dom-bas':80C 'email':4A,45B,48B,107C,125C,147C,163C 'email-deriv':146C 'enabl':118C 'execut':93C,152C 'extern':109C,114C 'externalresources.js':134C 'host':22B 'html':44B,106C 'imag':5A,34B,110C,115C,140C 'innerhtml':37B,143C 'insid':58B 'javascript':57B,95C 'log':61B 'logged-in':60B 'mail':67B,69B 'mailbox':161C 'make':50B 'malici':98C 'notic':35B,141C 'open':131C 'packag':19B 'read':66B,160C 'remot':90C 'run':8A,55B 'script':9A,86C,151C 'self':21B 'self-host':20B 'send':68B,121C,162C 'session':11A,63B,158C 'set':72B,166C 'site':85C 'sourc':116C 'special':123C 'tag':111C 'taken':40B 'text':7A,100C 'trigger':150C 'url':102C 'use':142C 'valu':39B,103C,149C 'version':26B 'victim':52B,130C,155C 'vulner':87C 'webmail':2A,23B,25B,74C","nicknames":[],"mitigations":[],"who_affected":"Cypht webmail installs in the affected range are exposed when a user opens an HTML email, and the exposure needs ALLOW_EXTERNAL_IMAGE_SOURCES to be enabled. The sources say the attacker only needs to send the email, so any deployment that receives mail from outside is in scope when the setting is on. Installs with external image sources disabled are described as not triggering the flaw, but the sources do not confirm this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T12:17:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113583","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113583","severity":null,"published_at":"2026-10-20T12:17:29+00:00","modified_at":"2026-10-22T22:18:04+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}