Stored Cross-Site Scripting in PMail by Jinnrry

CVE-2026-129168

What is CVE-2026-129168?

PMail versions 2.9.1 to 2.9.8 are susceptible to stored cross-site scripting (XSS) due to the mishandling of email attachments. The /attachments/{id}/{cid} endpoint returns sender-supplied Content-Types without proper sanitization. This flaw allows unauthenticated SMTP senders to attach malicious text/html files with embedded scripts, which may be triggered when recipients access their messages. If a user clicks on the modified cid link, it can lead to executing arbitrary scripts in their webmail session, compromising session integrity and potentially changing user passwords, including those of administrators.

References