EUVD-2026-69652
GHSA-r7q3-25g3-96cc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-delivered XSS requiring no attacker auth; scope changes to victim browser enabling session data theft and page modification, but no availability impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.
AnalysisAI
Cross-site scripting in Cypht webmail's contacts module (all versions before 2.12.2) allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser by crafting a malicious FROM email header. The contacts module's sanitizer strips only the first occurrence of each angle bracket character, so embedding redundant brackets around a script payload bypasses the filter entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to be running a Cypht instance at version 2.12.1 or earlier, to open a specifically crafted email in their Cypht webmail session, and then to explicitly click the Add Local Contacts function while viewing that email. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) accurately characterizes this as a moderate-severity issue: the attack is network-delivered with no attacker authentication requirement, but the subsequent-system impact is limited to the victim's browser session (SC:L/SI:L), and active user interaction - specifically two sequential steps - is required. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Cypht v2.12.2 or later; this release escapes FROM header values in the add-contact popup as detailed in PR #2072 (https://github.com/cypht-org/cypht/pull/2072) and commit 372343783b3d21c12f74bb88d0eef36c1579c062. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today