CVE-2026-103647
Received Received - Intake

XSS in hMailServer Webmail via Blob URL Rendering

Publication date: 2026-10-08

Last updated on: 2026-10-08

Assigner: GitLab Inc.

Description
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-08
Last Modified
2026-10-08
Generated
2026-10-08
AI Q&A
2026-10-08
EPSS Evaluated
N/A
NVD
CVE-2026-103647
EUVD
EUVD-2026-94836

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progressive Robot Ltd hMailServer 6.3.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in hMailServer's webmail component affecting versions 6.3.2 through 6.3.5. When a user receives an encrypted message and the webmail decrypts an S/MIME or OpenPGP attachment in the browser, the attachment is offered as a blob URL. If the user opens the attachment in a new tab and it is declared as text/html, the script runs in the webmail's origin, allowing session access.

Detection Guidance

Check hMailServer version with 'hMailServer.exe -version' or via the admin interface. Inspect webmail logs for decrypted S/MIME or OpenPGP attachments opened in new tabs. Monitor for unexpected script execution in webmail sessions or REST API calls from unusual origins.

Impact Analysis

An attacker who can send you an encrypted message could exploit this to read your emails, send mail from your account, or change account settings. This requires you to open the decrypted attachment in a new tab rather than downloading it. The REST API must be enabled for the webmail to be accessible.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive email data, potentially violating GDPR's data protection requirements or HIPAA's confidentiality rules. Unauthorized access to personal or health information may result in compliance breaches.

Mitigation Strategies

Upgrade hMailServer to version 6.3.6 or later. Disable the REST API if not required. Avoid opening decrypted attachments in new tabs; use desktop clients instead. Block external encrypted messages until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-103647. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart