CVE-2026-119761 in Mail Server
Summary
by MITRE • 10/30/2026
Axigen Mail Server WebMail before 10.6.39 and 10.7.1 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject script via unescaped sender display names in the conversation view. Attackers can send an email with HTML and script in the From display name that executes when the recipient opens the folder, enabling mailbox content theft or redirection.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The Axigen Mail Server WebMail interface contains a critical stored cross-site scripting vulnerability affecting versions prior to 10.6.39 and version 10.7.1. This security flaw stems from insufficient input validation and the failure to properly sanitize user-supplied data before rendering it in the web-based email client. Specifically, the application does not escape special HTML characters within sender display names when they are displayed in the conversation view of an inbox or folder. As a result, any malicious script embedded within this field is executed by the victim's browser rather than being treated as inert text. This lack of output encoding represents a fundamental failure in implementing secure coding practices for web applications that handle user-generated content from external sources such as email headers.
The operational impact of this vulnerability allows unauthenticated remote attackers to execute arbitrary JavaScript code within the context of the Axigen WebMail application on the target users' browsers. By crafting an email with HTML and script tags embedded in the From display name, an attacker can trigger the malicious payload when a victim opens the folder containing that message. This execution environment grants the attacker significant capabilities including session hijacking through cookie theft, keylogging to capture sensitive credentials entered into the web interface, phishing attacks by injecting fake login forms or deceptive content directly into the mail client view, and potentially redirecting users to malicious external sites. Since the payload is stored on the server within the email metadata, it remains active until the message is deleted, creating a persistent threat vector that can affect multiple recipients if the same malicious sender address is used across different accounts.
From an industry standard perspective, this vulnerability aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific nature of storing the payload within a database or file system for later retrieval classifies it under Stored XSS rather than reflected or DOM-based variants. In terms of adversary tactics, this exploit maps to MITRE ATT&CK technique T1059 Command and Control via Application Layer Protocol where email is used as a delivery mechanism, and potentially T1213 Data from Information Repositories if the attacker aims to exfiltrate mailbox contents. The ability to steal cookies or session tokens also relates to credential access techniques such as Browser Session Hijacking found in various threat actor profiles targeting enterprise communication platforms.
Mitigation strategies should prioritize immediate patching of the Axigen Mail Server software to version 10.6.39 or later where this issue has been resolved by implementing proper output encoding for all dynamic content derived from email headers. Administrators must ensure that the web application framework enforces strict Content Security Policy directives to restrict script execution sources and prevent inline scripts unless absolutely necessary, although patching remains the primary defense. Additionally, organizations should implement input validation at the point of receipt to reject or sanitize HTML tags in sender fields if such functionality is not required for business operations. Regular security audits focusing on web application firewall rules can help detect attempts to exploit this vector by monitoring for unusual patterns in email headers containing encoded script payloads before they reach vulnerable instances.