DOM-Based Cross-Site Scripting in Cypht Webmail by Cypht Org

CVE-2026-113583

What is CVE-2026-113583?

The Cypht webmail application versions 2.0.0 through 2.12.2 are susceptible to a DOM-based cross-site scripting vulnerability. This issue allows attackers to execute arbitrary JavaScript by manipulating the alt text or URL values of an external image tag within an HTML email, specifically when the ALLOW_EXTERNAL_IMAGE_SOURCES feature is enabled. An attacker can send a carefully crafted email, leading to unauthorized actions in the victim's authenticated session, which includes reading emails, sending messages, or changing user settings.

References