CVE-2026-113583 Details
Description
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
A DOM-based cross-site scripting vulnerability has been identified in Cypht Webmail versions 2.0.0 through 2.12.2. This vulnerability allows remote attackers to execute arbitrary JavaScript by manipulating alt text or URL values in an HTML email's external image tag, provided that the 'ALLOW_EXTERNAL_IMAGE_SOURCES' option is enabled. When a victim opens a crafted email, the 'externalResources.js' script processes the image tag using 'innerHTML' with decoded values from the email, which can lead to script execution in the context of the victim's authenticated session. This exploitation could be used to read mailbox contents, send emails, or alter account settings.
Users can upgrade to Cypht version 2.13.0, which addresses this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 20, 2026CISA-ADP
Assessed Oct 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cypht | >= 2.0.0, < 2.13.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 22, 2026 | CVE Modified | CISA-ADP |
| Oct 20, 2026 | New CVE Received | [email protected] |