{"id":"CVE-2026-129168","kind":"vulnerability","aliases":["CVE-2026-129168"],"related":[],"title":"PMail: stored XSS in attachments endpoint lets email senders run script","description":"PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid} endpoint returns email attachments verbatim with the sender-supplied Content-Type after cid: references are rewritten into attachment links. Unauthenticated SMTP senders can email a text/html attachment and a page-covering cid link, so a recipient who clicks the message runs script in their webmail session to change passwords, including the administrator's.","summary":"PMail 2.9.1 through 2.9.8 serves email attachments with the sender-supplied Content-Type, so a crafted HTML attachment linked from a message runs script in the recipient's webmail session. An unauthenticated sender can use this to change passwords, including the administrator's.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"PMail","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","pmail","self-hosted","webmail"],"not_affected_if":["version-outside-2.9.1-2.9.8"],"how_to_check":"- Check the installed PMail version against the affected range 2.9.1 through 2.9.8","fix":null,"status":"open","published_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","triaged_at":"2026-11-13T18:51:45+00:00","updated_at":"2026-11-13T18:51:45+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-13T18:51:45Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"PMail: stored XSS in attachments endpoint lets email senders run script","impact":"high","summary":"PMail 2.9.1 through 2.9.8 serves email attachments with the sender-supplied Content-Type, so a crafted HTML attachment linked from a message runs script in the recipient's webmail session. An unauthenticated sender can use this to change passwords, including the administrator's.","audience":"businesses","category":"other","nicknames":[],"who_cares":["pmail","self-hosted","webmail"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in users' webmail sessions, admin password changed","analyst_note":"Confirm fixed version and workaround from the vendor advisory (vulncheck link) or the PMail repository; sources here give no fix.","how_to_check":"- Check the installed PMail version against the affected range 2.9.1 through 2.9.8\n- unknown","plain_action":"","product_name":"PMail","needs_analyst":true,"not_affected_if":["version-outside-2.9.1-2.9.8"],"who_is_affected":"PMail instances in the 2.9.1 through 2.9.8 range are exposed, because the /attachments/{id}/{cid} endpoint returns attachments with the sender's Content-Type. Exploitation needs a recipient to click a crafted message in the webmail interface. Instances outside that version range are not described as affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000743,"input_tokens":4646,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-129168':14A,17A '-2026':13A,16A '/attachments':83C '2.9.1':26B,70C '2.9.8':28B,72C 'administr':68B,140C 'attach':5A,31B,44B,89C,105C,114C 'chang':64B,136C 'cid':85C,100C,120C 'click':126C 'contain':73C 'content':38B,97C 'content-typ':37B,96C 'cover':119C 'craft':42B 'cross':77C 'cross-sit':76C 'cve':12A,15A 'email':8A,30B,88C,111C 'endpoint':6A,86C 'host':23B 'html':43B 'id':84C 'includ':66B,138C 'let':7A 'link':45B,106C,121C 'messag':48B,128C 'page':118C 'page-cov':117C 'password':65B,137C 'pmail':1A,18A,20B,25B,69C 'recipi':53B,124C 'refer':101C 'return':87C 'rewritten':103C 'run':10A,49B,129C 'script':11A,50B,79C,130C 'self':22B 'self-host':21B 'sender':9A,35B,59B,94C,109C 'sender-suppli':34B,93C 'serv':29B 'session':56B,134C 'site':78C 'smtp':108C 'store':2A,75C 'suppli':36B,95C 'text/html':113C 'type':39B,98C 'unauthent':58B,107C 'use':61B 'verbatim':90C 'vulner':80C 'webmail':24B,55B,133C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"PMail instances in the 2.9.1 through 2.9.8 range are exposed, because the /attachments/{id}/{cid} endpoint returns attachments with the sender's Content-Type. Exploitation needs a recipient to click a crafted message in the webmail interface. Instances outside that version range are not described as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["pmail"],"ptokens":["pmail"],"labels":["medium","other","pmail","selfhosted","vendor","webmail"],"campaign_type":null,"search_a":"'-129168':14A,17A '-2026':13A,16A 'attach':5A 'cve':12A,15A 'email':8A 'endpoint':6A 'let':7A 'pmail':1A,18A 'run':10A 'script':11A 'sender':9A 'store':2A 'xss':3A","search_b":"'2.9.1':26B '2.9.8':28B 'administr':68B 'attach':31B,44B 'chang':64B 'content':38B 'content-typ':37B 'craft':42B 'email':30B 'host':23B 'html':43B 'includ':66B 'link':45B 'messag':48B 'password':65B 'pmail':20B,25B 'recipi':53B 'run':49B 'script':50B 'self':22B 'self-host':21B 'sender':35B,59B 'sender-suppli':34B 'serv':29B 'session':56B 'suppli':36B 'type':39B 'unauthent':58B 'use':61B 'webmail':24B,55B","search_c":"'/attachments':83C '2.9.1':70C '2.9.8':72C 'administr':140C 'attach':89C,105C,114C 'chang':136C 'cid':85C,100C,120C 'click':126C 'contain':73C 'content':97C 'content-typ':96C 'cover':119C 'cross':77C 'cross-sit':76C 'email':88C,111C 'endpoint':86C 'id':84C 'includ':138C 'link':106C,121C 'messag':128C 'page':118C 'page-cov':117C 'password':137C 'pmail':69C 'recipi':124C 'refer':101C 'return':87C 'rewritten':103C 'run':129C 'script':79C,130C 'sender':94C,109C 'sender-suppli':93C 'session':134C 'site':78C 'smtp':108C 'store':75C 'suppli':95C 'text/html':113C 'type':98C 'unauthent':107C 'verbatim':90C 'vulner':80C 'webmail':133C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T18:17:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-129168","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-129168","severity":null,"published_at":"2026-11-13T18:17:42+00:00","modified_at":"2026-11-13T18:17:42+00:00","first_seen_at":"2026-11-13T18:49:31+00:00","fetched_at":"2026-11-13T18:49:31+00:00","note":null}],"documents":[{"id":148626,"url":"https://www.vulncheck.com/advisories/pmail-2.9.1-through-2.9.8-stored-xss-via-inline-html-attachments","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}