Cross-Site Scripting in Cypht Contacts Module by Cypht Org

CVE-2026-73524

What is CVE-2026-73524?

The contacts module in Cypht, prior to version 2.12.2, is vulnerable to cross-site scripting (XSS). Attackers can exploit this vulnerability by embedding malicious payloads in the FROM email header, manipulating the application's sanitization process. The flaw allows the first occurrence of angle brackets to be sanitized, but subsequent brackets remain intact, posing a significant risk. When a victim accesses the Add Local Contacts feature, the crafted email can execute arbitrary script content in their browser, leading to potential data compromise and further exploitation.

References