Cypht CVE-2026-113583

Exploitation requires the ALLOW_EXTERNAL_IMAGE_SOURCES configuration option to be enabled (not the default posture), which causes externalResources.js to render a 'Source blocked' notice for external images. The attacker places the payload in the alt text or URL of an external image tag in an HTML email; the vulnerable code builds the notice with innerHTML using decoded email-derived values. Limiting factors that reduce realistic risk: the victim must actively open the malicious email (UI:P/passive interaction), the target feature must be explicitly enabled by the operator, and the affected version must be in the 2.0.0-2.12.2 range; the impact is bounded to the victim's already-authenticated webmail session rather than the server host.

This is a genuine but moderate-priority vulnerability, not an emergency. The vendor's CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P, score 5.3 Medium) reflects a remotely-delivered, unauthenticated-attacker DOM XSS whose impact is confined to the victim's browser session (VC:N/VI:N/VA:N on the vulnerable system, with SC:L/SI:L on the subsequent/session system). Expressed in CVSS 3.1 terms this maps to the classic stored-XSS profile of roughly 6.1 (S:C, C:L/I:L). No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. There is no CISA KEV listing and no public exploit code was supplied - the only code artifact is the vendor PATCH diff (PR #2118), which demonstrates the flaw's mechanism but is not an attacker POC. Two factors meaningfully reduce real-world risk: exploitation requires the non-default ALLOW_EXTERNAL_IMAGE_SOURCES option to be enabled, and it requires victim interaction (opening the malicious email). Combined with Cypht's small deployment footprint, this argues for routine patching rather than crisis response. No signals are strongly conflicting; the main gap is the absence of EPSS data to gauge exploitation probability.

An attacker sends a specially crafted HTML email to a Cypht user whose instance has ALLOW_EXTERNAL_IMAGE_SOURCES enabled, embedding a malicious payload in the alt text or URL of an external image tag. When the victim opens the email, externalResources.js builds the 'Source blocked' notice via innerHTML using the decoded, attacker-controlled values, executing arbitrary JavaScript in the victim's authenticated webmail session to read mail, send messages, or alter settings. No public exploit code was identified in the provided data; only the vendor's fixing PR is available.