CVE-2026-35390 Details
Description
Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server. Prior to 1.4.11, the reverse proxy (proxy.ts) set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This means cross-site scripting (XSS) attacks were logged but not blocked. Any user who could inject script content (e.g., via crafted email HTML) could execute arbitrary JavaScript in the context of the application, potentially stealing session tokens or performing actions on behalf of the user. This vulnerability is fixed in 1.4.11.
A cross-site scripting (XSS) vulnerability has been identified in Bulwark Webmail versions prior to 1.4.11. The issue arises from the reverse proxy setting the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This misconfiguration allowed XSS attacks to be logged without being blocked. Users who could inject script content, such as through crafted email HTML, could execute arbitrary JavaScript within the application context, potentially stealing session tokens or performing actions on behalf of the user.
Users are advised to upgrade to Bulwark Webmail version 1.4.11 or later, where this vulnerability has been fixed by setting the Content-Security-Policy header to enforce rather than report-only. Users deploying behind a separate reverse proxy that can enforce a Content-Security-Policy are not affected.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bulwarkmail/webmail/security/advisories/GHSA-6q52-98cr-qx65 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| bulwarkmail webmail | < 1.4.11 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 9, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | CVE Modified | CISA-ADP |
| Apr 6, 2026 | New CVE Received | [email protected] |