EUVD-2026-94836
GHSA-xr9h-mj6v-hm4m
Severity by source
AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Delivered via email over the network with no attacker privileges (PR:N), but AC:H and UI:R because it needs non-default webmail plus the victim opening an HTML attachment in a new tab; script in the webmail origin abusing the REST API makes S:C with C:H/I:H.
Primary rating from Vendor (GitLab).
CVSS VectorVendor: GitLab
Lifecycle Timeline
3DescriptionCVE.org
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.
AnalysisAI
Cross-site scripting in Progressive Robot hMailServer 6.3.2 through 6.3.5 can let a remote, unauthenticated attacker execute script in the webmail origin with a victim's session if the victim decrypts a crafted S/MIME (from 6.3.2) or OpenPGP (from 6.3.4) message and opens a text/html attachment in a new tab. The webmail is only served when the non-default REST API is enabled, and the attack requires user interaction, so realistic risk is materially lower than the 8.0 CVSS score. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires ALL of the following: (1) the hMailServer REST API must be enabled so the webmail is served at all - the description explicitly states this is not enabled by default; (2) the installation must be hMailServer 6.3.2 through 6.3.5, with S/MIME-based attacks possible from 6.3.2 and OpenPGP-based attacks from 6.3.4; (3) the attacker must be able to send the target user an encrypted (S/MIME or OpenPGP) message whose part is declared as media type text/html; and (4) the victim must decrypt that message in the browser and specifically open the decrypted attachment in a new tab - merely clicking to save the file does NOT trigger code execution. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The input CVSS of 8.0 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N) looks high, but the real-world risk is materially lower than the headline number suggests because several independent signals are weak or absent. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: upgrade to hMailServer v6.3.6, available at https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every hMailServer deployment and confirm which instances run versions 6.3.2 through 6.3.5, then determine whether the non-default REST API that serves webmail is enabled; where webmail is enabled and cannot be taken offline immediately, disable the REST API or restrict it to trusted networks, and warn users not to open text/html attachments from S/MIME or OpenPGP messages in a new tab. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Hmailserver
View allArbitrary JScript execution in Progressive Robot Ltd's hMailServer 6.0.0 through 6.3.3 on Windows lets an unauthenticate
Incorrect default permissions in the Windows installer for Progressive Robot hMailServer 6.0.0 through 6.3.5 let any loc
Heap-based buffer overflow in hMailServer 6.0.0 through 6.3.3 on Windows lets a local interactive user - with no hMailSe
Local privilege escalation in hMailServer 6.0.0 through 6.3.5 on Windows allows an authenticated local user-one with an
Local privilege escalation in Progressive Robot hMailServer 6.3.4 and 6.3.5 on Linux allows an attacker who already has
Denial of service in Progressive Robot hMailServer 6.3.4 and 6.3.5 lets a remote unauthenticated attacker stall mail del
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 lets a remote unauthenticated attacker stall mail
Denial of service in Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote unauthenticated attacker to make
Denial of service in hMailServer arises from quadratic-time parsing of JSON objects: the reader preserved the first inst
Unauthenticated network-based denial of service in the Linux builds of Progressive Robot hMailServer 6.3.0 through 6.3.5
DNS rebinding against Progressive Robot hMailServer 6.0.0 through 6.3.5 allows a remote, unauthenticated attacker to bru
Outbound SMTP delivery in Progressive Robot hMailServer 6.0.0 through 6.3.5 fails open when DANE (RFC 7672) validation c
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today