CVE-2026-113583
Received Received - Intake

DOM-based XSS in Cypht Webmail via Malicious Email Images

Publication date: 2026-10-20

Last updated on: 2026-10-20

Assigner: VulnCheck

Description
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-20
Generated
2026-10-20
AI Q&A
2026-10-20
EPSS Evaluated
N/A
NVD
CVE-2026-113583
EUVD
EUVD-2026-104966

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cypht-org cypht 2.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-113583 is a DOM-based cross-site scripting (XSS) vulnerability in Cypht webmail versions 2.0.0 through 2.12.2. It occurs when the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled. Attackers send malicious HTML emails with crafted alt text or URL values in an external image tag. When the victim opens the email, the externalResources.js code uses innerHTML to build a blocked-image notice, executing the malicious script in the victim's authenticated session.

Detection Guidance

To detect this vulnerability, inspect incoming emails for HTML content with external image tags containing malicious alt text or URLs. Check if ALLOW_EXTERNAL_IMAGE_SOURCES is enabled in Cypht configurations. Review the externalResources.js file in modules/core/js_modules/utils/ for the XSS vulnerability.

Impact Analysis

This vulnerability allows attackers to execute arbitrary JavaScript in your authenticated Cypht session. They could read your emails, send emails on your behalf, or change your account settings without your knowledge. The attack requires you to open a specially crafted email while logged into Cypht.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data within the webmail system, such as emails, contacts, or settings. For GDPR, this may result in violations of data confidentiality and integrity, potentially leading to unauthorized processing or disclosure of personal data. For HIPAA, it could allow unauthorized access to protected health information, compromising compliance with safeguards for electronic protected health information.

Mitigation Strategies

Upgrade Cypht to version 2.13.0 or later to patch the vulnerability. Disable the ALLOW_EXTERNAL_IMAGE_SOURCES setting if not required. Sanitize user-supplied input in email modules and review session handling for authentication failures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-113583. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart