CVE-2026-26483: Mettle SendPortal XSS Vulnerability

CVE-2026-26483 Overview

CVE-2026-26483 is a stored cross-site scripting (XSS) vulnerability affecting Mettle SendPortal version 3.0.1 and earlier. The flaw resides in the template management functionality of the /templates endpoint. The application fails to sanitize user-supplied input in the content parameter, allowing attackers to inject persistent JavaScript payloads. When authenticated users view an affected template, the malicious script executes in their browser context. This vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Attackers can persistently inject JavaScript into email templates, hijack authenticated sessions, steal credentials, and pivot to broader compromise of the SendPortal administrative interface.

Affected Products

Mettle SendPortal 3.0.1
Mettle SendPortal versions prior to 3.0.1
SendPortal template management module (/templates endpoint)

Discovery Timeline

2026-07-20 - CVE-2026-26483 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-26483

Vulnerability Analysis

SendPortal is an open-source self-hosted email marketing platform. The template management module accepts HTML content through the content parameter submitted to the /templates endpoint. The application stores this input in the database and renders it back to users without applying output encoding or input sanitization.

The attack requires user interaction, as a victim must load the poisoned template within the application interface. Because the payload is stored server-side, it executes for every user who subsequently accesses the template. The scope is changed, meaning the injected script executes with the privileges of the rendering context and can affect components beyond the vulnerable module.

Root Cause

The root cause is missing output encoding in the template rendering pipeline. User-controlled HTML submitted through the content field is stored verbatim and served back to browsers without HTML entity escaping or Content Security Policy enforcement. The application treats the content parameter as trusted markup rather than untrusted user input requiring neutralization before rendering.

Attack Vector

An attacker with permission to create or modify templates submits a crafted payload to the /templates endpoint. The payload embeds JavaScript inside HTML tags, event handlers, or <script> blocks placed in the template body. When an administrator or another user opens the template preview or edit view, the browser parses and executes the attacker's script. The attacker can then perform actions such as exfiltrating session cookies, issuing forged API requests, or modifying additional templates to expand the foothold.

Refer to the GitHub Gist Code Snippet for the disclosed proof-of-concept payload details.

Detection Methods for CVE-2026-26483

Indicators of Compromise

Template records in the SendPortal database containing <script>, javascript:, onerror=, onload=, or similar event handler attributes within the content column.
Outbound requests from browser sessions to unfamiliar domains immediately after accessing the /templates route.
Unexpected modifications to template records without corresponding audit log entries from a legitimate administrator.

Detection Strategies

Review web server access logs for POST and PUT requests to /templates containing URL-encoded HTML tags or JavaScript keywords in the content parameter.
Query the SendPortal templates table for stored HTML markup that includes executable script constructs.
Deploy a web application firewall (WAF) rule that flags XSS signatures targeting the /templates endpoint.

Monitoring Recommendations

Enable audit logging on template creation and modification actions with the submitting user, source IP, and payload size.
Monitor session activity for anomalies such as concurrent sessions from disparate geographic locations following template access.
Alert on browser console errors or Content Security Policy violation reports originating from authenticated SendPortal sessions.

How to Mitigate CVE-2026-26483

Immediate Actions Required

Restrict template creation and editing permissions to a minimal set of trusted administrators until a patched release is installed.
Audit existing templates in the database and remove any records containing script tags, inline event handlers, or javascript: URIs.
Rotate session tokens and administrative credentials for any account that accessed compromised templates.

Patch Information

No vendor patch reference is listed in the NVD entry at the time of publication. Monitor the GitHub SendPortal Repository for releases addressing this issue and upgrade beyond version 3.0.1 once a fix is published.

Workarounds

Deploy a strict Content Security Policy that disallows inline scripts and restricts script sources to trusted origins.
Place SendPortal behind a WAF configured to block XSS payloads targeting the /templates endpoint.
Implement server-side HTML sanitization in a reverse proxy layer to strip disallowed tags and attributes from template submissions.

bash

# Example NGINX Content Security Policy header for SendPortal
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;