CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOWEXTERNALIMAGESOURCES is enabled. Attackers can send ...

CVE-2026-113583

Cypht webmail versions 2.0.0 through 2.12.2 are vulnerable to a Stored DOM-based Cross-Site Scripting (XSS) flaw. When the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled, an attacker can execute arbitrary JavaScript by sending a specially crafted email. The vulnerability exists because the exter...