---
id: CVE-2026-103647
title: >-
  Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2
  through 6.3.5 allows a remote attacker who can send a user an encrypted
  message to run script in the webmail's origin with that user's session
summary: >-
  Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2
  through 6.3.5 allows a remote attacker who can send a user an encrypted
  message to run script in the webmail's origin with that user's session. When
  the webmail d…
severity: high
cvss: 8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N'
cwe:
  - CWE-79
vendor: Progressive Robot Ltd
product: hMailServer
affected:
  - hMailServer >= 6.3.2 < 6.3.6
published: '2026-10-08'
updated: '2026-10-08'
sourceUpdated: '2026-10-08T21:02:43.860'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-103647'
references:
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/releases/v6.3.6'
    label: cve@gitlab.com
  - url: 'https://gitlab.com/hmailserver/hmailserver/-/work_items/52'
    label: cve@gitlab.com
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-08T14:22:42.954493Z'
ingestedAt: '2026-10-08T11:31:27.688Z'
---

## Overview

Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.