CVE-2026-102372: GestSup before 3.2.62 Stored XSS via Email Body in LOGIN IMAP Connector
GestSup versions before 3.2.62 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
GestSupto a version that resolves this vulnerability.Fixed in 3.2.62
Event History
Frequently Asked Questions
Who is exposed to this issue?
GestSup deployments using the IMAP LOGIN connector and a version before 3.2.62 are exposed if attackers can send email to the mailbox monitored by that connector. Technicians who view the resulting ticket descriptions or replies in their browsers are the users at risk of script execution.
What does an attacker need to exploit it?
An attacker does not need authentication, but must be able to send a crafted HTML email to the monitored mailbox. The email can contain script tags or event handlers that are stored in ticket content and execute when a technician views it.
How can I tell whether my deployment is affected?
Check whether the installation is running a GestSup version earlier than 3.2.62 and whether it uses the IMAP LOGIN connector to ingest email. Review tickets and replies created from inbound email for unexpected HTML, script tags, or event-handler attributes.
What should be done if patching cannot happen immediately?
Limit or disable email ingestion through the affected IMAP LOGIN connector where possible, and restrict who can send mail to the monitored mailbox. Treat inbound HTML email content as untrusted and avoid opening affected ticket content in technician browsers until the issue is remediated.