CVE-2026-107272: Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue in practice?
An attacker must control or be able to intercept the SMTP server configured in a Gophish sending profile. They can return SMTP error messages containing script payloads.
When does the injected script execute?
The script can execute when an administrator views campaign results or sends a test email. This requires administrator interaction with the affected Gophish interface.
What could an attacker gain from successful exploitation?
Successful script execution can allow theft of API keys. The reported impact includes low confidentiality and integrity impact, with no availability impact.
Which deployments should be investigated?
Investigate Gophish installations through version 0.12.1 that use SMTP sending profiles, particularly where the SMTP server is externally operated, untrusted, or could be intercepted. Review whether administrators have viewed campaign results or sent test emails using such profiles.