Description
PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Jinnrry | PMail | 2.5.0 ≤2.9.8 | — |
References
- https://vul.yulun.ac.cn/20261027/pmail/
- https://github.com/Jinnrry/PMail/issues/371
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/controllers/email/send.go#L144-L184
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/services/detail/detail.go#L20-L29
- https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/fe/src/views/EmailDetailView.vue#L52
- https://www.vulncheck.com/advisories/pmail-2.5.0-through-2.9.8-stored-xss-via-api-email-send-html-body