Vulnerability Description
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/cypht-org/cypht/pull/2118/changes/75d2fb83d228be2aaa37036a11e
- https://github.com/cypht-org/cypht/releases#release-v2.13.0
- https://www.vulncheck.com/advisories/cypht-through-stored-dom-xss-via-externalre
FAQ
What is CVE-2026-113583?
CVE-2026-113583 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in ...
How severe is CVE-2026-113583?
CVE-2026-113583 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-113583?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.