TI-2026-65369 Aliases CVE-2026-102372 GHSA-ghhh-8g6j-jh47

GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector

LOW 23CWE-79Published 2026-09-29 · Updated 2026-09-30

Key facts

Attack vector: Network
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Cross-site scripting
Confidentiality · integrity · availability: None · None · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00211 11th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed GestSup (GestSup): 3.2.61

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
GestSup	GestSup	before 3.2.61	3.2.61	Patch available	CNA

GestSup VendorGestSup Affected before 3.2.61 Fixed in 3.2.61 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:gestsup:gestsup::::::::	—	—	GestSup

cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:* Versions — — ·GestSup

Remediation

Fix · CNA GestSup (GestSup) Fixed in 3.2.61

Timeline

2026-10-02 Threatist record created from CVE-2026-102372
2026-10-03 Alias added: GHSA-ghhh-8g6j-jh47

References

Exploit 1

https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/

Patch 1

https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.61&type=patch

Other 2

TI-2026-65370 GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter CVSS 4.0HIGH 7.1
TI-2023-28509 A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute… CVSS 3.1MEDIUM 5.4
TI-2023-28510 A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily… CVSS 3.1MEDIUM 4.3
TI-2021-11728 Gestsup before 3.2.10 allows account takeover through the password recovery functionality… CVSS 3.1CRITICAL 9.8
TI-2026-64662 GestSup before 3.2.62 Remote Code Execution via IMAP Attachment CVSS 4.0CRITICAL 9.2
TI-2026-17804 GestSup <= 3.2.60 CSRF Allows Privileged Actions CVSS 4.0HIGH 8.9

See all 11 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences