CVE-2026-75872: HTML Injection in MailerUp double opt-in verification email
HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured sending identity, via the firstname field of the subscription request, which is interpolated unescaped into the double opt-in verification email.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.1.3
Event History
Frequently Asked Questions
Which deployments are exposed?
Instances of maalfer MailerUp before 1.1.3 that expose a public subscription form with double opt-in enabled are affected. The issue is triggered through the first_name field submitted to that form.
What does an attacker need to exploit this?
An attacker does not need to authenticate. They need access to the public subscription form and can supply a chosen recipient address along with HTML in the first_name field.
What should be done if patching is not immediately possible?
Upgrade MailerUp to version 1.1.3 or later. If upgrading cannot happen immediately, restrict access to the public subscription form or disable the affected double opt-in email workflow where operationally feasible.