CVE-2026-113583: Cypht Webmail DOM-Based XSS Vulnerability

CVE-2026-113583 Overview

CVE-2026-113583 is a DOM-based cross-site scripting (XSS) vulnerability in Cypht webmail versions 2.0.0 through 2.12.2. The flaw resides in the externalResources.js client-side code, which builds the blocked-image notice using innerHTML with decoded values taken directly from email content. When ALLOW_EXTERNAL_IMAGE_SOURCES is enabled, a remote attacker can send a crafted HTML email containing a malicious alt text or URL in an external image tag. Opening the email triggers JavaScript execution in the victim's authenticated session, allowing the attacker to read mailboxes, send email, or change account settings. The vulnerability is tracked under CWE-79.

Critical Impact
Attackers can execute arbitrary JavaScript in a victim's authenticated webmail session simply by having the victim open a crafted email, enabling mailbox access and account manipulation.

Affected Products

Cypht webmail 2.0.0 through 2.12.2
Installations with ALLOW_EXTERNAL_IMAGE_SOURCES enabled
Fixed in Cypht release v2.13.0

Discovery Timeline

2026-10-20 - CVE-2026-113583 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-113583

Vulnerability Analysis

Cypht is an open-source webmail client written primarily in PHP with a JavaScript front-end. The vulnerability lives in externalResources.js, which handles the user experience around blocking and allowing external images in HTML email. When an email contains external image references, Cypht renders a notice informing the user that images were blocked and offers an option to load them. That notice is constructed by concatenating values from the email into an HTML string and assigning the result to an element's innerHTML property. Because the values are first decoded and never sanitized or escaped, any HTML or script content embedded in the alt attribute or image URL is parsed as live markup. The result is script execution inside the Cypht application origin while the user is authenticated.

Root Cause

The root cause is unsafe DOM manipulation. The front-end code trusts attacker-controlled data from an incoming email and injects it into the DOM via innerHTML. Content Security Policy, output encoding, and safe DOM APIs such as textContent or setAttribute are not applied before rendering. The configuration flag ALLOW_EXTERNAL_IMAGE_SOURCES enables the code path, so deployments with that setting enabled are exposed by default when receiving external HTML mail.

Attack Vector

An attacker crafts an HTML email containing an <img> tag with a malicious alt attribute or src URL that includes HTML markup and a script payload. The attacker sends the email to any Cypht user. When the victim opens the message in the Cypht web interface, externalResources.js builds the blocked-image notice and injects the attacker-supplied values into the DOM. The injected script runs in the victim's browser under the Cypht origin and inherits the session. From there, the attacker can issue authenticated requests to read messages, exfiltrate mail contents, send email as the victim, or modify account preferences. User interaction is limited to opening the email, which is a routine action.

Technical details and the upstream fix are documented in the Cypht pull request #2118 changes and the VulnCheck advisory.

Detection Methods for CVE-2026-113583

Indicators of Compromise

Inbound HTML emails containing <img> tags with script-like content or HTML markup embedded in alt attributes.
Unexpected outbound mail sent from a Cypht user account shortly after a specific message was opened.
Unusual IMAP or Cypht API activity such as bulk message reads, folder enumeration, or settings changes originating from a user's browser session.
Browser console errors or anomalous DOM mutations on the Cypht message view page.

Detection Strategies

Inspect mail gateway logs for HTML messages containing <img ... alt="...<script"> or image URLs that include HTML entities decoding to script tags.
Correlate the timestamp of a user opening an email with subsequent authenticated actions in Cypht application logs.
Review the running Cypht version against the fixed release and flag any deployment at 2.0.0 through 2.12.2 with ALLOW_EXTERNAL_IMAGE_SOURCES enabled.

Monitoring Recommendations

Enable verbose logging on the Cypht application and forward webmail access logs to a centralized analytics platform for correlation.
Monitor web server responses for anomalous JavaScript errors or Content Security Policy violations on message rendering routes.
Alert on configuration drift where ALLOW_EXTERNAL_IMAGE_SOURCES is turned on after being disabled.

How to Mitigate CVE-2026-113583

Immediate Actions Required

Upgrade Cypht to version 2.13.0 or later, which contains the patch for externalResources.js.
If upgrading immediately is not possible, disable ALLOW_EXTERNAL_IMAGE_SOURCES in the Cypht configuration to prevent the vulnerable code path from being invoked.
Invalidate active Cypht sessions and require users to re-authenticate after patching.
Audit mail stored in affected accounts for messages that may have triggered exploitation.

Patch Information

The upstream fix is included in Cypht release v2.13.0. The code change in pull request #2118 replaces unsafe innerHTML assembly with safe DOM construction and proper escaping of email-derived values. Administrators should apply the official release rather than attempt a manual backport. Additional context is available in the VulnCheck advisory.

Workarounds

Set ALLOW_EXTERNAL_IMAGE_SOURCES to a disabled value in the Cypht configuration until the patched release can be deployed.
Restrict access to the Cypht web interface via network controls so that only trusted users can reach it while remediation is in progress.
Deploy a strict Content Security Policy on the Cypht virtual host that disallows inline script execution to reduce the impact of DOM-based XSS payloads.

bash

# Configuration example: disable external image sources in Cypht
# Edit the Cypht configuration file (hm3.ini or site-specific config)
ALLOW_EXTERNAL_IMAGE_SOURCES=false

# Restart the web server after applying the change
sudo systemctl restart apache2   # or nginx / php-fpm depending on deployment