Gophish EUVD-2026-94403

The attacker must control the SMTP server referenced by a Gophish sending profile, or be positioned to intercept/MITM the SMTP connection, so that a malicious server error string is returned to Gophish. Exploitation then requires a privileged administrator to view campaign results or trigger a test email (passive user interaction, UI:P). Limiting factors: the attacker needs a pre-existing position of control over or interception of the sending profile's SMTP endpoint (a non-default, attacker-favorable precondition captured as AT:P), and the payload only fires when an admin interacts; impact is limited to the admin browser session (API key theft), with no direct confidentiality/integrity/availability impact on the Gophish host itself.

This is a low-priority issue despite a publicly available exploit. The official CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L) scores only 2.3, and the signals are internally consistent: the AT:P (attack requirement present) and UI:P (passive user interaction) metrics reflect that an attacker must first control or MITM a sending-profile SMTP server AND wait for an administrator to view campaign results or send a test email. There is NO vulnerable-system impact (VC/VI/VA all N) - impact is confined to the subsequent system (SC:L/SI:L), i.e. the admin's browser session, with the practical payoff being theft of Gophish API keys. POC code exists (Ostorlab blog, VulnCheck advisory), but this is NOT in CISA KEV and there is no evidence of active exploitation - POC availability and active exploitation are distinct signals and only the former is present. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be factored in. The high precondition burden (attacker must already control the SMTP endpoint used by a sending profile, plus a privileged admin must interact) sharply limits real-world risk even though the attack vector is nominally network-based.

An attacker who controls, or can intercept traffic to, the SMTP server configured in a Gophish sending profile returns a crafted SMTP error message containing a script payload. When a Gophish administrator later views the campaign results page or sends a test email, the unescaped error message renders and the script executes in the admin's authenticated browser session, exfiltrating the Gophish API key. Public POC/exploit material is available via the Ostorlab and VulnCheck write-ups.