CVE-2026-113583 in Cypht
Summary
by MITRE • 10/20/2026
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/20/2026
Cypht webmail versions 2.0.0 through 2.12.2 are susceptible to a DOM-based cross-site scripting vulnerability that stems from improper handling of user-supplied input within the client-side JavaScript logic. The core technical flaw resides in how the application processes external image sources when the configuration directive ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. In this operational mode, Cypht attempts to display images hosted on remote servers by fetching them and displaying a placeholder or notice if they fail to load. This process involves calling innerHTML with data derived directly from email headers, specifically the alt text attribute and URL values found in HTML external image tags. Because these input fields are not adequately sanitized before being injected into the DOM, an attacker can inject malicious JavaScript payloads that execute within the context of the victim's authenticated session when the malformed email is viewed.
The attack vector relies on social engineering to deliver a crafted HTML email containing specially constructed img tags with malicious alt text or URL parameters. When the recipient opens this message in Cypht, the client-side script externalResources.js attempts to render the blocked-image notice by assigning the unsanitized input directly to an element's innerHTML property. This action bypasses standard browser security checks because the injection occurs via DOM manipulation rather than server-rendered HTML, making it a classic example of a DOM-based XSS flaw. The execution context is critical here; since Cypht requires authentication to access mailboxes, any script executed through this vulnerability runs with full privileges associated with that user account. This allows the attacker to perform actions such as reading sensitive emails, sending messages on behalf of the victim, or modifying application settings without detection by traditional server-side security controls.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Specifically, it falls under DOM-based XSS where the script is executed in the browser environment rather than on the server side. In terms of offensive security frameworks, this exploit maps to MITRE ATT&CK technique T1059.007, which covers JavaScript execution within a web browser context. The ability to read mailboxes and send emails corresponds further to techniques involving data exfiltration and account manipulation, highlighting the severe operational impact on confidentiality and integrity of user communications.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. Users should immediately upgrade Cypht to version 2.13 or later where this issue has been patched by implementing proper input validation and output encoding for all dynamic content injected into the DOM. For environments that cannot update immediately, disabling the ALLOW_EXTERNAL_IMAGE_SOURCES configuration option effectively neutralizes the attack vector by preventing the application from processing external image tags in a manner that triggers the vulnerable code path. Additionally, deploying Content Security Policy headers can help mitigate potential impacts by restricting script execution sources and preventing inline scripts unless explicitly allowed through nonces or hashes. Regular security audits of client-side JavaScript logic are recommended to identify similar patterns where user input is directly bound to DOM properties without adequate sanitization.