CVE-2026-23605: GFI MailEssentials Stored XSS Vulnerability

CVE-2026-23605 Overview

GFI MailEssentials AI versions prior to 22.4 contain a stored cross-site scripting (XSS) vulnerability in the Attachment Filtering rule creation workflow. An authenticated user can supply HTML/JavaScript payloads in the ctl00$ContentPlaceHolder1$pv1$TXB_RuleName parameter to /MailEssentials/pages/MailSecurity/attachmentchecking.aspx, which is stored and subsequently rendered in the management interface without proper sanitization, enabling script execution in the context of other logged-in users.

Critical Impact

Authenticated attackers can inject malicious scripts that execute in the browsers of administrators and other users accessing the management interface, potentially leading to session hijacking, credential theft, or administrative actions being performed on behalf of the victim.

Affected Products

• GFI MailEssentials AI versions prior to 22.4

Discovery Timeline

• 2026-02-19 - CVE CVE-2026-23605 published to NVD
• 2026-02-19 - Last updated in NVD database

Technical Details for CVE-2026-23605

Vulnerability Analysis

This stored XSS vulnerability exists in the Attachment Filtering rule creation functionality of GFI MailEssentials AI. The application fails to properly sanitize user-supplied input in the rule name field before storing it in the database and subsequently rendering it in the management interface. When an authenticated user creates or modifies an attachment filtering rule, the value submitted in the ctl00$ContentPlaceHolder1$pv1$TXB_RuleName parameter is accepted without adequate input validation or output encoding.

The stored nature of this vulnerability makes it particularly concerning because the malicious payload persists in the application's database and executes every time an administrator or user views the affected page. This creates opportunities for persistent attacks against multiple users of the management interface.

Root Cause

The root cause is improper input validation and output encoding (CWE-79: Improper Neutralization of Input During Web Page Generation). The application stores user-supplied data in the TXB_RuleName field without sanitizing HTML and JavaScript constructs, and then renders this data directly into the management interface HTML without proper encoding or escaping. This allows attackers to break out of the expected data context and inject executable scripts.

Attack Vector

The attack is network-based and requires the attacker to have valid authentication credentials to the GFI MailEssentials AI management interface. The attacker navigates to the Attachment Filtering configuration page at /MailEssentials/pages/MailSecurity/attachmentchecking.aspx and creates a new rule with a malicious rule name containing JavaScript code. When other administrators subsequently view the attachment filtering rules, the injected script executes in their browser session.

The attack requires some user interaction (victim must access the affected page), making this a persistent XSS scenario where the payload lies dormant until triggered by victim navigation. The attacker's script can then access session tokens, perform administrative actions, or redirect users to malicious sites.

Detection Methods for CVE-2026-23605

Indicators of Compromise

• Unusual JavaScript or HTML tags present in rule names within the Attachment Filtering configuration
• Suspicious entries in web server access logs showing requests to attachmentchecking.aspx with encoded script tags
• Unexpected administrative actions or configuration changes following visits to the MailEssentials management interface
• Reports of session hijacking or unauthorized access by legitimate administrators

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block XSS payloads in POST requests to the MailEssentials management interface
• Monitor database entries for attachment filtering rules containing HTML or JavaScript syntax
• Deploy browser-based XSS detection extensions for administrators accessing the management console
• Configure Content Security Policy (CSP) headers to restrict inline script execution

Monitoring Recommendations

• Enable detailed logging for the GFI MailEssentials management interface and review logs for suspicious parameter values
• Monitor for unusual patterns of access to the attachmentchecking.aspx endpoint
• Implement alerting for any rule names containing potentially malicious characters such as <, >, or script

How to Mitigate CVE-2026-23605

Immediate Actions Required

• Upgrade GFI MailEssentials AI to version 22.4 or later immediately
• Audit existing Attachment Filtering rules for any suspicious or malicious rule names and remove them
• Restrict access to the management interface to only trusted administrators until patching is complete
• Implement network-level access controls to limit exposure of the management interface

Patch Information

GFI has released version 22.4 of MailEssentials AI which addresses this stored XSS vulnerability. Organizations should download and apply the update from the GFI Product Release Documentation. Additional technical details are available in the VulnCheck Advisory on GFI MailEssentials.

Workarounds

• Limit management interface access to trusted networks only using firewall rules or VPN requirements
• Implement a web application firewall with XSS detection capabilities in front of the MailEssentials management interface
• Review and audit all existing Attachment Filtering rules for potentially malicious content
• Consider disabling the ability to create new attachment filtering rules until the patch can be applied

# Example: Restrict access to MailEssentials management interface via IIS
# Add to web.config or configure via IIS Manager
# Limit access to specific IP addresses or ranges
<security>
  <ipSecurity allowUnlisted="false">
    <add ipAddress="10.0.0.0" subnetMask="255.255.0.0" allowed="true" />
    <add ipAddress="192.168.1.0" subnetMask="255.255.255.0" allowed="true" />
  </ipSecurity>
</security>