Read the docs
TI-2026-69495 Aliases CVE-2026-103647

Cross-site scripting in hMailServer webmail via encrypted attachments

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

hMailServer from 6.3.2 before 6.3.6 has a cross-site scripting flaw in its webmail. A remote attacker who can send a user an encrypted message can run script in the webmail origin with that user's session if the user opens a decrypted HTML attachment in a new tab. The attacker could then read the mailbox, send mail and change the account through the REST API, which is needed for the webmail and is not enabled by default.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00247 16th percentileScored 2026-11-07
Fix Fixed hMailServer (Progressive Robot Ltd): 6.3.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Progressive Robot LtdhMailServer6.3.2 to before 6.3.66.3.6Patch availableCNA
  • hMailServer VendorProgressive Robot Ltd Affected 6.3.2 to before 6.3.6 Fixed in 6.3.6 Patch available CNA

Remediation

Update hMailServer 6.3.2 through 6.3.5 to 6.3.6, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA hMailServer (Progressive Robot Ltd) Fixed in 6.3.6

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Progressive Robot hMailServer 6.3.6

    23 records Highest priority Priority LOW 23 LOW

    Other records, highest priority first

    • TI-2026-69567 Inefficient processing in hMailServer stalls mail deliveryPriority LOW 39
    • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mailPriority LOW 39
    • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of servicePriority LOW 39
    Show all 23 records →

Timeline

  1. 2026-10-08 Threatist record created from CVE-2026-103647

References

Other 2

  • TI-2026-64884 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in hMailServer CVSS 3.1CRITICAL 9.8
  • TI-2026-76418 Unchecked loop limit in hMailServer lets remote attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69567 Inefficient processing in hMailServer stalls mail delivery CVSS 3.1HIGH 7.5
  • TI-2026-69565 Infinite loop in hMailServer MIME handling lets attackers stop mail CVSS 3.1HIGH 7.5
  • TI-2026-69564 Inefficient DKIM and ARC checks in hMailServer cause denial of service CVSS 3.1HIGH 7.5
  • TI-2026-69562 Inefficient JSON parsing in hMailServer lets attackers halt mail CVSS 3.1HIGH 7.5
See all 41 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences