---
id: CVE-2026-113583
title: Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js
summary: >-
  Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting
  vulnerability that allows remote attackers to execute arbitrary JavaScript by
  crafting malicious alt text or URL values in an HTML email's external image
  tag wh…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: cypht-org
product: cypht
affected:
  - cypht >= 2.0.0 < 2.13.0
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T11:35:29.543Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113583'
references:
  - url: >-
      https://github.com/cypht-org/cypht/pull/2118/changes/75d2fb83d228be2aaa37036a11eea68d82122d85
  - url: 'https://github.com/cypht-org/cypht/releases#release-v2.13.0'
    label: Vendor Patch
  - url: >-
      https://www.vulncheck.com/advisories/cypht-through-stored-dom-xss-via-externalresources-js
    label: >-
      VulnCheck Advisory: Cypht 2.0.0 through 2.12.2 Stored DOM XSS via
      externalResources.js
tags:
  - cve.org
ingestedAt: '2026-10-20T12:05:07.322Z'
---

## Overview

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.

## Affected

- `cypht >= 2.0.0 < 2.13.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.