CVE-2026-10234: Mettle Sendportal XSS Vulnerability

CVE-2026-10234 Overview

CVE-2026-10234 is a cross-site scripting (XSS) vulnerability affecting Mettle SendPortal versions up to 3.0.1. The flaw resides in an unspecified function within the /webview/ file, part of the Campaign Handler component. An authenticated attacker can manipulate the content argument to inject arbitrary script that executes in a victim's browser session. The attack is network-reachable and requires user interaction to trigger. Public exploit details are available, and the project maintainers have not responded to the upstream issue report at the time of disclosure. This issue is tracked under CWE-79 — Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated attackers can inject JavaScript via campaign content, leading to session compromise, phishing, and unauthorized actions within the SendPortal interface.

Affected Products

Mettle SendPortal versions up to and including 3.0.1
Campaign Handler component (/webview/)
Self-hosted SendPortal email campaign deployments

Discovery Timeline

2026-06-01 - CVE-2026-10234 published to the National Vulnerability Database (NVD)
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-10234

Vulnerability Analysis

The vulnerability is a stored or reflected cross-site scripting (XSS) flaw in the Campaign Handler component of SendPortal, an open-source self-hosted email marketing application. SendPortal allows users to compose and dispatch campaign content through web-based interfaces. The /webview/ endpoint renders campaign content without sufficiently neutralizing HTML and JavaScript supplied through the content argument.

Because attacker-controlled markup is reflected into the rendered HTML, an attacker with low-privilege access to compose campaigns can embed <script> payloads. When a recipient or administrator views the campaign through the web view, the payload executes within the SendPortal origin. The attack requires user interaction, such as clicking a link or opening a preview, which limits automated exploitation but does not prevent targeted abuse.

Root Cause

The root cause is missing output encoding on the content parameter handled by the Campaign Handler. User-supplied campaign body content is concatenated into HTML responses without contextual escaping, allowing tags and event handlers to break out of intended text contexts. This is a classic instance of CWE-79.

Attack Vector

The attacker authenticates as a low-privilege SendPortal user able to create or edit campaigns. They store a script payload inside the campaign content field. Any user who loads /webview/ for the affected campaign triggers JavaScript execution in their browser. The malicious script can exfiltrate session cookies, perform forged requests against SendPortal APIs, or redirect victims to attacker-controlled domains.

No verified proof-of-concept code is published; refer to the VulDB CVE-2026-10234 entry and the upstream GitHub Issue #338 for additional technical context.

Detection Methods for CVE-2026-10234

Indicators of Compromise

Campaign records containing HTML tags such as <script>, <iframe>, onerror=, or javascript: URIs within the content field.
HTTP requests to /webview/ returning responses with unescaped attacker-supplied markup.
Unexpected outbound requests from administrator browsers to unfamiliar domains shortly after loading SendPortal campaign previews.

Detection Strategies

Inspect the SendPortal database tables that store campaign body content for embedded <script> tags and DOM event handler attributes.
Deploy a Content Security Policy (CSP) report-only header and monitor reports for violations originating from /webview/.
Use a web application firewall (WAF) rule set to flag campaign create or update requests containing script-like payloads.

Monitoring Recommendations

Forward SendPortal web server access logs to a centralized SIEM and alert on /webview/ requests with anomalous response sizes or script-related substrings.
Audit campaign editor activity for low-privilege accounts that submit HTML markup containing executable script constructs.
Track browser-side errors and CSP violations from administrator workstations interacting with the SendPortal console.

How to Mitigate CVE-2026-10234

Immediate Actions Required

Restrict access to the SendPortal administrative interface to trusted networks via VPN or IP allow-listing until a fix is released.
Revoke or downgrade campaign-creation privileges for accounts that do not require them.
Review existing campaign records and remove any entries containing script tags, inline event handlers, or javascript: URIs.

Patch Information

No vendor patch has been released. According to the advisory, the maintainers were notified through the upstream issue tracker but have not responded. Monitor the SendPortal GitHub repository and GitHub Issue #338 for fix announcements. Until a patched release is available, treat all SendPortal 3.0.1 and earlier installations as vulnerable.

Workarounds

Place SendPortal behind a reverse proxy that enforces a strict Content Security Policy disallowing inline scripts on /webview/ responses.
Apply a WAF rule that rejects POST or PUT requests to campaign endpoints when the content parameter contains <script, onerror=, or javascript: substrings.
Disable or restrict the /webview/ preview functionality through web server access controls if it is not required for business operations.

bash

# Example nginx configuration: restrict /webview/ and enforce CSP
location /webview/ {
    allow 10.0.0.0/8;
    deny all;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'none'" always;
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    proxy_pass http://sendportal_backend;
}