CVE-2026-102372 in GestSup
Summary
by MITRE • 09/29/2026
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/29/2026
GestSup versions prior to 3.2.62 contain a critical input validation flaw within its IMAP LOGIN connector module, specifically concerning the handling of HTML content found in email bodies. This vulnerability arises from an insufficient sanitization process when ingesting data from external mail servers into the application's ticketing system. The software fails to adequately filter or encode potentially malicious markup and scripting elements before storing them in persistent storage structures such as ticket descriptions and reply threads. Consequently, any HTML content embedded within incoming emails is rendered directly by the client-side interface without proper context-aware escaping or neutralization of executable code vectors.
The operational impact of this flaw allows unauthenticated attackers to execute cross-site scripting attacks against system technicians who access their mailboxes through the GestSup web interface. By sending specially crafted emails containing script tags and event handlers, an attacker can inject arbitrary JavaScript into ticket records. When a technician views these tickets or replies within the application's browser-based environment, the malicious scripts are executed in the context of the authenticated session. This execution enables the theft of sensitive ticket data, including customer information and internal notes, as well as the potential for unauthorized actions such as modifying other tickets, changing user permissions, or performing phishing attacks against colleagues by leveraging the technician’s trusted credentials and access rights.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific mechanism involves stored XSS where malicious scripts are permanently stored within target servers via email ingestion. In terms of tactical mapping to the MITRE ATT&CK framework, this vulnerability facilitates techniques associated with Collection from Browser Local Storage and Credential Access through browser-based interception. It also supports lateral movement if the stolen credentials or session tokens allow access to other internal systems. The lack of output encoding for user-controlled data originating from email sources represents a fundamental failure in secure coding practices regarding trust boundaries between external inputs and internal application logic.
To mitigate this vulnerability, organizations running GestSup versions before 3.2.62 should immediately upgrade to version 3.2.62 or later where the input sanitization mechanisms have been corrected. Until an update is applied, administrators can implement a compensating control by configuring their mail server to strip HTML content from incoming emails and convert them to plain text format before they reach the GestSup IMAP connector. Additionally, implementing strict Content Security Policy headers within the web application interface can help restrict the execution of inline scripts even if some malicious code manages to bypass other filters. Regular security audits focusing on input validation for all data ingestion points, particularly those involving external email protocols, are essential to prevent similar vulnerabilities in future development cycles.