CVE-2026-104083: SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content
SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SmarterMailto a version that resolves this vulnerability.Fixed in 9777
Event History
Frequently Asked Questions
Which deployments are affected?
SmarterMail installations running a build before 9777 are affected. The issue is in the webmail message rendering path at /interface/message-iframe.
What does an attacker need to exploit this?
The attacker can exploit the issue remotely without authentication by sending a crafted iCal calendar message. Exploitation requires a recipient to open the message in the webmail interface.
What is the impact after successful exploitation?
Script executes in the recipient's webmail session, which can enable data exfiltration. The described payload bypasses the custom sanitizer through MathML foreign content and is not constrained by the interface's permissive Content-Security-Policy.
How can I determine whether I am exposed?
Check the SmarterMail build number. Systems running a build earlier than 9777 should be treated as vulnerable.