PMAIL · CVE-2026-129169 · Other
NO FIX YET
PMail versions 2.5.0 through 2.9.8 accept unsanitized HTML sent to /api/email/send, so a logged-in user can store a script in a message. When an administrator opens that message, the script runs in their session and can call privileged APIs such as password changes, enabling account takeover.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Teams that run PMail 2.5.0 through 2.9.8 with user accounts that can send through /api/email/send are exposed, because the stored script executes when an administrator views the message. Instances where only trusted users can log in, or that run a later version, are not affected by this description. The sources do not name a fixed version.
Not affected if no-untrusted-accounts, version-outside-range
Who cares email, pmail, self-hosted
2.5.0 through 2.9.8./api/email/send.No fix yet, per the sources.
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.