CVE-2026-54893 Details
Description
URL path injection in the Microsoft Graph adapter of Swoosh. Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (for example a relay, a contact form, or a "send as" feature), an attacker can place URL-special characters such as /, ?, or # in the local part of the address to escape the intended path segment and rewrite the path and query string of the request. Because the same authenticated POST is sent with the application's Microsoft Graph bearer token, the attacker can redirect it to other Graph endpoints within the token's scopes and control the request's query string. Applications that always use a fixed, trusted from address are not affected. This issue affects swoosh: from 1.12.0 before 1.26.3.
A URL path injection vulnerability has been identified in the Microsoft Graph adapter of Swoosh, specifically in versions 1.12.0 prior to 1.26.3. The issue arises because the adapter constructs API request URLs by directly inserting the sender's email address into the path without proper validation or percent-encoding. This flaw can be exploited in applications that use untrusted or user-influenced input to determine the 'from' address, such as through contact forms or 'send as' features. An attacker can inject URL-special characters to escape the intended path segment, redirecting the request to other Graph endpoints within the token's scopes and manipulating the query string. However, applications that use a fixed, trusted 'from' address are not affected.
Users can update to Swoosh version 1.26.3 or later, where this vulnerability has been patched. Alternatively, validate or reject sender addresses that contain characters outside the allowed RFC 5321 set before passing the email to the adapter. As another option, set a static URL in the adapter configuration to bypass the 'from' address interpolation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 6, 2026CISA-ADP
Assessed Jul 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cna.erlef.org/cves/CVE-2026-54893.html | EEF | AdvisoryRemedy |
| https://github.com/swoosh/swoosh/commit/23bfcdab71aee4613858ba6d116bb3311b72aa58 | EEF | |
| https://github.com/swoosh/swoosh/commit/e38235453e81d1727bfc8d91e69ec4cb211ccf61 | EEF | Source CodeVendor |
| https://github.com/swoosh/swoosh/security/advisories/GHSA-754j-98wh-57rf | EEF | AdvisoryExploitRemedyVendor |
| https://osv.dev/vulnerability/EEF-CVE-2026-54893 | EEF | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-116 | Improper Encoding or Escaping of Output | EEF |
Affected Products
| Product | Versions |
|---|---|
| Swoosh | >= 1.12.0, < 1.26.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | CVE Modified | EEF |
| Jul 6, 2026 | CVE Modified | CISA-ADP |
| Jul 6, 2026 | New CVE Received | EEF |