PMAIL · CVE-2026-129168 · Other
NO FIX YET
PMail 2.9.1 through 2.9.8 serves email attachments with the sender-supplied Content-Type, so a crafted HTML attachment linked from a message runs script in the recipient's webmail session. An unauthenticated sender can use this to change passwords, including the administrator's.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
PMail instances in the 2.9.1 through 2.9.8 range are exposed, because the /attachments/{id}/{cid} endpoint returns attachments with the sender's Content-Type. Exploitation needs a recipient to click a crafted message in the webmail interface. Instances outside that version range are not described as affected.
Not affected if version-outside-2.9.1-2.9.8
Who cares pmail, self-hosted, webmail
No fix yet, per the sources.
PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.