CVE-2026-107272 in Gophish
Summary
by MITRE • 10/07/2026
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/07/2026
The vulnerability identified in Gophish versions up to 0.12.1 represents a significant security flaw involving both stored and reflected cross-site scripting vectors that exploit the application's interaction with external Simple Mail Transfer Protocol servers. This issue arises from insufficient input validation and output encoding when processing error messages returned by SMTP servers configured within sending profiles. When an administrator configures or tests these email delivery mechanisms, the system accepts raw data from the remote mail server without adequately sanitizing special characters that could be interpreted as executable code in a web browser context.
The operational impact of this vulnerability is severe because it allows attackers who control or can intercept traffic to a sending profile's SMTP server to inject malicious JavaScript payloads into the Gophish application environment. By crafting specific error responses, an attacker can trigger these scripts when administrators view campaign results or send test emails through the compromised profiles. This execution context grants the injected code access to the administrative session of the victim user, effectively bypassing same-origin policy protections that typically isolate web applications from malicious content originating from external sources.
The primary objective for attackers leveraging this flaw is credential theft and unauthorized API key exfiltration. Since Gophish relies heavily on its application programming interface for automation and integration with other security tools, stolen API keys provide a persistent foothold within the target infrastructure. These credentials can be used to manipulate phishing campaigns, steal sensitive data from simulated targets, or further escalate privileges by interacting with backend services that trust these tokens. The combination of stored persistence in campaign logs and reflected execution during active testing phases makes this vulnerability particularly dangerous for organizations using Gophish as part of their security awareness training programs.
From a classification perspective, this flaw aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting across multiple categories including stored XSS and reflected XSS. In the context of the MITRE ATT&CK framework, this vulnerability facilitates techniques related to Collection via Browser Capture or Screen Capture under T1056, specifically leveraging input validation weaknesses to execute arbitrary code within a trusted application environment. It also relates to Credential Access through browser session hijacking if cookies are stolen alongside API keys.
Mitigation strategies should focus on immediate remediation of the underlying input handling mechanisms. Developers must implement strict output encoding for all data derived from external SMTP servers before rendering it in HTML contexts, ensuring that special characters such as angle brackets and quotes are escaped to prevent script execution. Input validation should be applied at multiple layers, including server-side parsing of SMTP error responses, to reject or sanitize any content containing potential scripting tags. For organizations currently running affected versions, upgrading to a patched release is the most effective immediate countermeasure until code-level fixes can be verified in production environments.