---
id: "CVE-2026-119761"
kind: "vulnerability"
aliases: ["CVE-2026-119761"]
title: "Axigen WebMail: sender display names run script in the conversation view"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["axigen", "infrastructure", "mail-server", "self-hosted", "webmail"]
not_affected_if: ["versions-patched", "webmail-disabled"]
published_at: "2026-10-30T18:17:26+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:57:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119761", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# Axigen WebMail: sender display names run script in the conversation view

Axigen Mail Server's WebMail does not escape sender display names in the conversation view. An attacker who sends an email with script in the From display name can run that script in the browser of the recipient when they open the folder, enabling mailbox content theft or redirection.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Axigen WebMail version in the admin console or the WebMail footer and compare it with the fixed versions

## Fix

- Axigen Mail Server WebMail: upgrade to `10.6.39` on the 10.6 line or `10.7.1` on the 10.7 line

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119761

## From the sources

Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_