What is the CVSS score of CVE-2026-25529?

CVE-2026-25529 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Postal are affected by CVE-2026-25529?

Postal SMTP servers running versions below 3.3.5 are vulnerable to HTML injection attacks that could allow attackers to compromise administrative accounts and gain unauthorized access to email…

How to fix or mitigate CVE-2026-25529?

Within 24 hours: Identify all Postal instances in your environment and document their versions; restrict administrative interface access to trusted networks only. Within 7 days: Implement WAF rules to sanitize HTML input to the admin interface; establish monitoring for suspicious admin interface activity. Within 30 days: Upgrade to Postal 3.3.5 or later immediately upon availability; consider alternative SMTP solutions if upgrade timeline extends beyond 60 days.

Postal CVE-2026-25529

HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-03-12 security-advisories@github.com

XSS

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 19:57 vuln.today

CVE Published

Mar 12, 2026 - 17:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be injected in to the page which may modify the page in a misleading way or allow for unauthorised javascript to be executed. Fixed in 3.3.5 and higher.

AnalysisAI

Postal SMTP server versions below 3.3.5 contain a stored cross-site scripting (XSS) vulnerability in the admin interface where the API's "send/raw" method fails to properly escape user-supplied data, allowing authenticated attackers to inject malicious HTML and JavaScript. An attacker with API access could manipulate the admin dashboard or execute unauthorized actions in the context of an administrator's session. No patch is currently available for affected versions.

Technical ContextAI

Classified as CWE-79 (Cross-site Scripting (XSS)). Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be injected in to the page which may modify the page in a misleading way or allow for unauthorised javascript to be executed. Fixed in 3.3.5 and higher.

Affected ProductsAI

Component: admin.

RemediationAI

Fixed in version 3.3.5. Implement output encoding and Content Security Policy headers. Restrict network access to the affected service where possible.