CVE-2026-113583: Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable ALLOW_EXTERNAL_IMAGE_SOURCES to prevent processing external image content in HTML emails.
Cypht webmail ALLOW_EXTERNAL_IMAGE_SOURCES = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Cypht 2.0.0 through 2.12.2 are exposed when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled and they open an HTML email containing a crafted external image tag.
What does an attacker need to exploit it?
An attacker needs to send the victim a specially crafted HTML email with malicious alt text or URL values in an external image tag. No attacker authentication is required, but the victim must open the email.
What is the likely impact if exploitation succeeds?
JavaScript executes in the victim's authenticated Cypht session. The attacker may be able to read mailboxes, send email, or change settings using that session.
What can be done if upgrading is not immediately possible?
Disable ALLOW_EXTERNAL_IMAGE_SOURCES to prevent the vulnerable external-image handling path from being used.