Read the docs
TI-2026-76820 Aliases CVE-2026-113583GHSA-w69r-hqpc-72f2

Stored DOM cross-site scripting in Cypht via external image notice

Priority LOW 24CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cypht webmail from 2.0.0 before 2.13.0 contains a DOM-based cross-site scripting flaw in its external image handling. When ALLOW_EXTERNAL_IMAGE_SOURCES is enabled, the externalResources.js code builds the blocked-image notice with innerHTML using values decoded from the email's image tag, so crafted alt text or URL values are not neutralized (CWE-79). A remote attacker can send a crafted HTML email, and when the victim opens it, JavaScript runs in the victim's authenticated session, allowing mailbox reads, email sending and settings changes. User interaction is required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00389 33rd percentileScored 2026-11-07
Fix Fixed cypht (cypht-org): 2.13.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
cypht-orgcypht2.0.0 to before 2.13.02.13.0Patch availableCNA
  • cypht Vendorcypht-org Affected 2.0.0 to before 2.13.0 Fixed in 2.13.0 Patch available CNA

Remediation

Upgrade cypht to version 2.13.0, which is the fixed version listed for this product.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA cypht (cypht-org) Fixed in 2.13.0

Timeline

  1. 2026-10-20 Threatist record created from CVE-2026-113583
  2. 2026-10-20 Alias added: GHSA-w69r-hqpc-72f2
  3. 2026-10-23 CISA SSVC decision points changed

References

Patch 2

  • TI-2026-50271 Cypht < 2.12.2 PHP Object Injection RCE via back_query Parameter CVSS 4.0HIGH 8.7
  • TI-2026-51628 Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences