GHSA-vx3x-mxfj-w8gcMediumCVSS 5.4
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows...
🔗 CVE IDs covered (1)
📋 Description
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
🔗 References (8)
- https://nvd.nist.gov/vuln/detail/CVE-2026-129169
- https://github.com/Jinnrry/PMail/issues/371
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/fe/src/views/EmailDetailView.vue#L52
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/controllers/email/send.go#L144-L184
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/services/detail/detail.go#L20-L29
- https://vul.yulun.ac.cn/20261027/pmail
- https://www.vulncheck.com/advisories/pmail-2.5.0-through-2.9.8-stored-xss-via-api-email-send-html-body
- https://github.com/advisories/GHSA-vx3x-mxfj-w8gc