CVE-2026-73524

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-09-01

Last updated on: 2026-09-08

Assigner: VulnCheck

Description

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-01

Last Modified

2026-09-08

Generated

2026-10-12

AI Q&A

2026-09-02

EPSS Evaluated

2026-10-11

NVD

CVE-2026-73524

Affected Vendors & Products

Vendor	Product	Version / Range
cypht-org	cypht	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

CVE-2026-73524 is a cross-site scripting (XSS) vulnerability in Cypht versions before 2.12.2. It exists in the contacts module where the application fails to properly sanitize email headers. Attackers can exploit this by sending an email with a malicious FROM header containing script payloads in angle brackets. The sanitization only removes the first angle bracket pair, leaving additional ones intact, which execute scripts in the victim's browser when they open the message and access the Add Local Contacts function.

Detection Guidance

Detecting this vulnerability requires inspecting email headers for crafted FROM fields containing multiple angle brackets or script payloads. Check Cypht logs for suspicious contact additions and review email headers for patterns like <script> or excessive angle brackets. No specific commands are provided in the context.

Impact Analysis

This vulnerability allows remote attackers to execute arbitrary scripts in your browser when you open a crafted email and access the Add Local Contacts function. This could lead to session hijacking, theft of sensitive data, or unauthorized actions on your behalf. The impact depends on your environment and the permissions of the Cypht application.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling cross-site scripting attacks that may lead to unauthorized data access or manipulation. If exploited, it could compromise user data confidentiality or integrity, which are key requirements under these regulations.

Mitigation Strategies

Upgrade Cypht to version 2.12.2 or later to address the XSS vulnerability in the contacts module. Additionally, implement input validation for email headers and sanitize FROM fields to remove all angle brackets and script tags before processing.

Hi! I’m here to help you understand CVE-2026-73524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70