EUVD-2026-33568
GHSA-49hc-rwwc-mfv5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was detected in Mettle sendportal up to 3.0.1. This affects an unknown part of the file /webview/ of the component Campaign Handler. The manipulation of the argument content results in cross site scripting. The attack can be launched remotely. The exploit is now public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
AnalysisAI
Stored or reflected cross-site scripting in sendportal's Campaign Handler allows an authenticated low-privilege remote attacker to inject malicious script via the 'content' argument at the /webview/ endpoint, affecting all versions up to and including 3.0.1. A victim user must interact with the crafted content for the payload to execute, resulting in low-integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis is incorrect here - publicly available exploit code exists (E:P in CVSS temporal), and the vendor has not responded to the coordinated disclosure, leaving no patch available.
Technical ContextAI
sendportal is an open-source self-hosted email marketing platform developed by Mettle (CPE: cpe:2.3:a:mettle:sendportal:*:*:*:*:*:*:*:*). The vulnerable component is the Campaign Handler, which processes campaign content rendered at the /webview/ route. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting): user-supplied input in the 'content' parameter is not adequately sanitized or encoded before being reflected or stored and subsequently rendered in the browser. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:U) indicates the attack is network-accessible, requires no special conditions, needs low-level authenticated access, and requires a victim to interact with the malicious content. The unchanged scope (S:U) confines the impact to the application's own security context.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor was notified via a responsible disclosure issue report but has not responded, and no fixed version is available. Administrators should monitor the GitHub repository at https://github.com/mettle/sendportal/ and the issue tracker at https://github.com/mettle/sendportal/issues/338 for any upstream fix. As a compensating control, restrict access to the /webview/ Campaign Handler endpoint via web server or reverse-proxy ACLs to trusted IP ranges or authenticated sessions with elevated roles, reducing the attacker population that can inject content. Deploying a Web Application Firewall (WAF) with XSS filtering rules targeting the 'content' parameter at /webview/ can reduce exploit reliability, though WAF bypass is possible and this is not a substitute for a code fix. Additionally, enforcing strict Content-Security-Policy (CSP) headers on the /webview/ route can materially limit the impact of any successfully injected script by blocking inline execution. Organizations running sendportal in multi-tenant environments or with untrusted low-privilege users should consider disabling campaign content editing for those roles until a patch is released.
More in Sendportal
View allAuthorization bypass in mettle Sendportal up to version 3.0.1 permits authenticated remote users to circumvent object-le
Authorization bypass in SendPortal's workspace invitation handler allows authenticated low-privilege users to delete wor
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today