Cross-Site Scripting Vulnerability in Bulwark Webmail from Stalwart Mail Server

CVE-2026-35390

What is CVE-2026-35390?

Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, had a significant vulnerability prior to version 1.4.11. The reverse proxy configuration improperly set the Content-Security-Policy-Report-Only header instead of the critical enforcing Content-Security-Policy header. As a result, while cross-site scripting attacks were logged, they were not blocked. This flaw enabled attackers to inject malicious script content, often through crafted email HTML, allowing for the execution of arbitrary JavaScript in the application's context. Consequently, attackers could potentially steal session tokens or execute actions as if they were the user.

References