---
id: CVE-2026-73524
title: >-
  Cypht before 2.12.2 contains a cross-site scripting vulnerability in the
  contacts module that allows remote attackers to execute arbitrary script
  content by embedding malicious payloads within angle brackets in the FROM
  email header
summary: >-
  Cypht before 2.12.2 contains a cross-site scripting vulnerability in the
  contacts module that allows remote attackers to execute arbitrary script
  content by embedding malicious payloads within angle brackets in the FROM
  email header. The…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-09-01'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73524'
references:
  - url: >-
      https://github.com/cypht-org/cypht/commit/372343783b3d21c12f74bb88d0eef36c1579c062
    label: disclosure@vulncheck.com
  - url: 'https://github.com/cypht-org/cypht/pull/2072'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/cypht-org/cypht/releases/tag/v2.12.2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cypht-xss-via-from-email-header-in-contacts-module
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00407
epssPercentile: 0.32175
ingestedAt: '2026-09-08T21:11:12.289Z'
---

## Overview

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.