CVE-2026-129169: PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

Q: Who can exploit this issue, and who is at risk from the payload?

An attacker needs an authenticated PMail account and must be able to send a message through /api/email/send containing unsanitized HTML. Administrators are the primary downstream targets because the injected script executes when they view the malicious message.

Q: What could exploitation allow an attacker to do?

The stored script runs in an administrator's browser context and can make privileged API calls. The reported impact includes changing account passwords, which can lead to account takeover.

Q: How can I determine whether my deployment is affected?

Deployments running PMail versions 2.5.0 through 2.9.8 are affected if authenticated users can submit HTML email bodies through /api/email/send. A suspicious message may contain HTML event-handler payloads, such as an img element with an onerror handler.

Published Nov 13, 2026

Updated

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

Affected Software

1 affected component

PMail>=2.5.0<=2.9.8

Event History

Nov 13, 2026

CVE Published

via MITRE·05:21 PM

Data Sourced

via MITRE·05:21 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·06:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

An attacker needs an authenticated PMail account and must be able to send a message through /api/email/send containing unsanitized HTML. Administrators are the primary downstream targets because the injected script executes when they view the malicious message.

What could exploitation allow an attacker to do?

The stored script runs in an administrator's browser context and can make privileged API calls. The reported impact includes changing account passwords, which can lead to account takeover.

How can I determine whether my deployment is affected?

Deployments running PMail versions 2.5.0 through 2.9.8 are affected if authenticated users can submit HTML email bodies through /api/email/send. A suspicious message may contain HTML event-handler payloads, such as an img element with an onerror handler.

CVE-2026-129169: PMail 2.5.0 through 2.9.8 Stored XSS via /api/email/send HTML Body

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What could exploitation allow an attacker to do?

How can I determine whether my deployment is affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue, and who is at risk from the payload?

What could exploitation allow an attacker to do?

How can I determine whether my deployment is affected?