EUVD-2026-88598
GHSA-rhv9-26qc-872f
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft email with nested MIME encoded-word payload
-
DeliverySend to monitored GestSup mailbox
-
ExploitConnector double-decodes subject after HTML escape
-
ExecutionMalicious script stored on ticket
-
PersistTechnician opens ticket in web UI
-
ImpactJavaScript executes in technician session
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the target GestSup instance (before 3.2.62) to have the IMAP OAuth connector enabled and actively monitoring a mailbox - this is a specific, feature-gated deployment mode, not a default install. Delivery is unauthenticated (any attacker who can email the monitored mailbox), but the payload only executes when a technician subsequently opens the affected ticket in the web interface (UI:P - passive user interaction). Limiting factors: the connector must be configured, the mailbox reachable by external mail, and a privileged technician must view the ticket for impact to occur; the flaw yields no direct server-side confidentiality/integrity/availability impact, only script execution in the technician's browser context. |
| Impact | This is a genuine but moderate-priority stored XSS. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) confirms remote, unauthenticated, low-complexity injection - an attacker only needs to email a monitored mailbox - but exploitation is gated by passive user interaction (a technician must open the poisoned ticket) and the impact is limited to subsequent-system confidentiality/integrity (SC:L/SI:L), consistent with cross-site scripting rather than direct server compromise (VC/VI/VA all N). No EPSS score, no CISA KEV listing, and no public POC are present in the data, so there is no evidence of active or automated exploitation - the signals point to a real-but-not-urgent issue rather than a high-severity emergency. The 5.3 score is a fair reflection: the unauthenticated network delivery raises exposure, but the XSS blast radius and the required technician interaction cap real-world risk. Note the injection is unauthenticated to DELIVER but the payload only fires inside an authenticated technician session, so it is effectively an unauth-to-privileged-context pivot. |
| Exploit ScenarioDerived | An attacker sends an email to a mailbox that GestSup monitors via its IMAP OAuth connector, placing a nested MIME encoded-word payload in the Subject header. The connector HTML-escapes the subject and then MIME-decodes it a second time, unwrapping the encoded-word into raw |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 29, 2026
Stored cross-site scripting in GestSup versions before 3.2.62 allows unauthenticated attackers to inject JavaScript into technician sessions by emailing a monitored mailbox with nested MIME encoded-words in the subject line; the IMAP OAuth connector double-decodes the subject after HTML escaping, so the decoded payload survives sanitization and is stored with the ticket. Exploitation is feature-gated: the instance must have the IMAP OAuth connector enabled and actively polling a mailbox reachable from outside, and the script only fires when a technician subsequently opens the affected ticket in the web interface (passive user interaction), yielding script execution in the technician's browser rather than direct server-side impact. No public exploit code has been identified at time of analysis, and the flaw is not confirmed as actively exploited (CISA KEV); risk is real but moderate given the configuration prerequisites.
RemediationAI
Vendor-released patch: upgrade to GestSup 3.2.62 or later using the stable patch package at https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.62&type=patch or the standard download page at https://gestsup.fr/index.php?page=download; confirm the deployed version after upgrading, as the CPE range covers all releases below 3.2.62. If immediate upgrade is not feasible, disable the IMAP OAuth connector (or stop it from polling the mailbox) until patched - this removes the ingestion vector entirely at the cost of losing automatic ticket creation from email - or restrict the monitored mailbox so external/untrusted senders cannot deliver to it, accepting that this breaks legitimate inbound-email ticketing from outside the organization and only reduces, not eliminates, risk from internal senders. A Content-Security-Policy on the GestSup web interface that disallows inline script and restricts script-src to same-origin assets provides defense-in-depth against this and similar stored XSS, though it requires testing because GestSup's UI may rely on inline handlers and a strict policy can break functionality. Note that the flaw yields no server-side confidentiality, integrity, or availability impact per the assessed vectors, so the primary residual exposure is session/session-token theft or technician-side actions from the injected script; monitor the affected mailbox for suspicious encoded-word subjects while remediation is pending.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
GestSup is a French open-source IT helpdesk/ticketing application, and the affected component is its IMAP OAuth mail connector, which ingests inbound email and converts it into tickets. MIME encoded-words (RFC 2047) allow non-ASCII subjects to be transmitted as Q- or B-encoded tokens; the connector HTML-escapes the raw subject first and then applies MIME decoding, so a nested or doubly-encoded subject resolves after the escaping step and reintroduces angle brackets, quotes, and other markup that the escaper had neutralized. That decoded, unsanitized string is persisted as the ticket subject and rendered in the technician's ticket view, producing stored XSS (CWE-79, improper neutralization of input during web page generation). The CPE cpe:2.3:a:gestsup:gestsup:*:*:*:*:*:*:*:* indicates the vendor/product pairing with an open version range, i.e., all releases below the 3.2.62 fix. Because the injection vector is inbound email to a mailbox rather than an HTTP request, the attacker needs no GestSup account, but the vulnerable code path only exists where the IMAP OAuth connector has been configured and pointed at a mailbox that external senders can reach.
Know when Gestsup gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Unauthenticated remote email delivery (AV:N/PR:N), but requires a technician to view the ticket (UI:R); stored XSS crosses into the victim's browser context (S:C) with limited C/I and no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
DescriptionCVE.org
GestSup versions before 3.2.62 contain a stored cross-site scripting vulnerability in the IMAP OAuth connector that double-decodes MIME-encoded email subjects after HTML escaping. Unauthenticated attackers can send crafted emails to monitored mailboxes with nested MIME encoded-words to inject JavaScript that executes in technician sessions when viewing tickets.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in GestSup XSS and Access Control Vulnerabilities
View all 3Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote). Rated critical sever
Unauthenticated remote code execution affects GestSup, the PHP-based IT asset and ticket management application, in all
GestSup through version 3.2.60 fails to implement CSRF protections, enabling attackers to forge requests that execute ac
GestSup versions before 3.2.60 allow authenticated attackers to execute SQL injection attacks through insufficiently san
GestSup prior to version 3.2.60 is vulnerable to SQL injection in the ticket creation feature, allowing authenticated at
Authenticated attackers can exploit SQL injection in GestSup's search functionality (versions before 3.2.60) to manipula
GestSup before version 3.2.60 contains a pre-authentication stored XSS vulnerability in API error logging that allows un
Exploit-DB