CVE-2026-104083
Received Received - Intake

Stored XSS in SmarterMail Webmail Interface

Publication date: 2026-10-09

Last updated on: 2026-10-09

Assigner: VulnCheck

Description
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-09
Last Modified
2026-10-09
Generated
2026-10-09
AI Q&A
2026-10-09
EPSS Evaluated
N/A
NVD
CVE-2026-104083
EUVD
EUVD-2026-95888

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Smartertools Smartermail 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-104083 is a stored mutation cross-site scripting (XSS) vulnerability in SmarterMail versions before build 9777. It allows remote attackers to inject executable scripts by placing payloads inside a style element nested within MathML foreign content. The custom HTML sanitizer incorrectly treats this as inert text, but browsers reinterpret it as live markup.

Detection Guidance

Check SmarterMail version with: curl -s http://your-server/SmarterMail | grep -i version. If version is below 9777, the system is vulnerable. Inspect webmail interface logs for requests to /interface/message-iframe containing MathML or style elements.

Impact Analysis

This vulnerability enables attackers to execute scripts in a victim's webmail session when a crafted calendar message is opened. It allows data exfiltration and script execution without restrictions from the interface's Content-Security-Policy, potentially compromising user data and session integrity.

Compliance Impact

This vulnerability enables script execution and data exfiltration in webmail sessions, which could lead to unauthorized access to sensitive data. For GDPR, this may violate principles of data protection and user rights. For HIPAA, it could compromise protected health information if exploited in healthcare environments.

Mitigation Strategies

Upgrade SmarterMail to build 9777 or later immediately. Temporarily disable calendar message processing if upgrade is delayed. Review and tighten Content-Security-Policy headers to block inline scripts and MathML elements.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104083. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart