{"id":"CVE-2026-113583","title":"Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js","summary":"Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag wh…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"cna","cwe":["CWE-79"],"vendor":"cypht-org","product":"cypht","affected":["cypht >= 2.0.0 < 2.13.0"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T11:35:29.543Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113583","references":[{"url":"https://github.com/cypht-org/cypht/pull/2118/changes/75d2fb83d228be2aaa37036a11eea68d82122d85"},{"url":"https://github.com/cypht-org/cypht/releases#release-v2.13.0","label":"Vendor Patch"},{"url":"https://www.vulncheck.com/advisories/cypht-through-stored-dom-xss-via-externalresources-js","label":"VulnCheck Advisory: Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js"}],"tags":["cve.org"],"ingestedAt":"2026-10-20T12:05:07.322Z","slug":"CVE-2026-113583","body":"## Overview\n\nCypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.\n\n## Affected\n\n- `cypht >= 2.0.0 < 2.13.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}