Description
PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users to inject script by creating a TOTP exception with an unescaped description. When a global administrator views totp-exceptions.php, the script runs in the admin session and can issue authenticated admin requests using the page's CSRF token.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| postfixadmin | postfixadmin | ≤ 4.0.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | postfixadmin | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | postfixadmin | No fix yet | — |
| Ubuntu 26.04 LTS | postfixadmin | No fix yet | — |
| Ubuntu 16.04 LTS | postfixadmin | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | postfixadmin | No fix yet | — |
| Ubuntu Pro 22.04 LTS | postfixadmin | No fix yet | — |
| Ubuntu Pro 20.04 LTS | postfixadmin | No fix yet | — |
| Ubuntu Pro 18.04 LTS | postfixadmin | No fix yet | — |
References
- GitHub Issue #1185 issue-tracking
- https://github.com/postfixadmin/postfixadmin product
- Fix commit patch
- https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/public/users/totp-exceptions.php#L128 technical-description
- https://github.com/postfixadmin/postfixadmin/blob/v4.0.5/templates/totp-exceptions.tpl#L56 technical-description
- https://github.com/postfixadmin/postfixadmin/pull/1172 technical-description patch issue-tracking
- https://github.com/postfixadmin/postfixadmin/pull/1186 technical-description patch issue-tracking
- VulnCheck Advisory: PostfixAdmin through 4.0.5 Stored XSS via TOTP Exception Description third-party-advisory