Cypht Cross-Site Scripting in Contacts Module Before 2.12.2

Executive Summary

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht versions before 2.12.2. It exists in the contacts module where the application fails to properly sanitize email headers. Attackers can exploit this by sending an email with a malicious FROM header containing script payloads in angle brackets. The sanitization only removes the first angle bracket pair, leaving additional ones intact, which execute scripts in the victim's browser when they open the message and access the Add Local Contacts function.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires inspecting email headers for crafted FROM fields containing multiple angle brackets or script payloads. Check Cypht logs for suspicious contact additions and review email headers for patterns like <script> or excessive angle brackets. No specific commands are provided in the context.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary scripts in your browser when you open a crafted email and access the Add Local Contacts function. This could lead to session hijacking, theft of sensitive data, or unauthorized actions on your behalf. The impact depends on your environment and the permissions of the Cypht application.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling cross-site scripting attacks that may lead to unauthorized data access or manipulation. If exploited, it could compromise user data confidentiality or integrity, which are key requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Cypht to version 2.12.2 or later to address the XSS vulnerability in the contacts module. Additionally, implement input validation for email headers and sanitize FROM fields to remove all angle brackets and script tags before processing.

Useful 0 Not Useful 0