CVE-2026-54893: Swoosh MsGraph Path Traversal Vulnerability

CVE-2026-54893 Overview

CVE-2026-54893 is a URL path injection vulnerability in the Microsoft Graph adapter of Swoosh, an Elixir email delivery library. The Swoosh.Adapters.MsGraph module builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. Applications that derive the from address from untrusted input allow attackers to inject URL-special characters like /, ?, or # to rewrite the request path and query string. The malicious request still carries the application's authenticated Microsoft Graph bearer token. This issue affects swoosh from version 1.12.0 before 1.26.3 and is tracked under [CWE-116].

Critical Impact
Attackers who influence the sender address can redirect authenticated Microsoft Graph API calls to other endpoints within the application's token scopes, potentially accessing or modifying Graph resources beyond email sending.

Affected Products

Swoosh library (Elixir) versions 1.12.0 through 1.26.2
Applications using Swoosh.Adapters.MsGraph with user-influenced from addresses
Elixir applications integrating Microsoft Graph API for email delivery via Swoosh

Discovery Timeline

2026-07-06 - CVE-2026-54893 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-54893

Vulnerability Analysis

The vulnerability resides in the ms_graph.ex adapter of Swoosh. The adapter constructs the Microsoft Graph sendMail endpoint URL through direct string interpolation of the sender email address. Because email local parts can technically contain characters that are also URL delimiters, an attacker who controls the from field can inject /, ?, or # characters. These characters break out of the intended path segment and rewrite the target path or append arbitrary query parameters.

The forged request still uses the application's authenticated POST to Microsoft Graph. It carries the same bearer token the application holds for legitimate email delivery. An attacker can therefore reach any Graph endpoint permitted by that token's scopes.

Root Cause

The root cause is improper output encoding [CWE-116]. The adapter treated the email address as a trusted path component and did not apply percent-encoding before URL construction. Applications that always use a fixed, trusted from address are unaffected because there is no attacker-controlled input to inject into the path.

Attack Vector

Exploitation requires an application feature that lets untrusted input influence the from address, such as a mail relay, a contact form, or a "send as" workflow. The attacker submits a crafted address whose local part contains URL-special characters. Swoosh interpolates the raw string into the API URL, producing a request that targets an attacker-chosen Graph endpoint and query string.

elixir

       config[:url]
     else
       {_, from_email} = email.from
-      "#{base_url(config)}/users/#{from_email}/sendMail"
+      encoded_email = URI.encode(from_email, &URI.char_unreserved?/1)
+      "#{base_url(config)}/users/#{encoded_email}/sendMail"
     end
   end

Source: GitHub Commit e3823545. The patch applies URI.encode/2 with URI.char_unreserved?/1 so that any URL-special character in the sender address is percent-encoded before URL construction.

Detection Methods for CVE-2026-54893

Indicators of Compromise

Outbound HTTPS requests to graph.microsoft.com with paths containing raw /, ?, or # characters embedded in the /users/{from} segment.
Microsoft Graph audit log entries showing API calls to endpoints unrelated to sendMail originating from the application's service principal.
Unexpected Graph API activity correlated with mail submissions from user-facing forms or relays.

Detection Strategies

Inspect application logs for from addresses containing characters outside RFC 5321 allowed local-part syntax, particularly /, ?, and #.
Enable Microsoft Graph activity logs and alert on API paths accessed by the service principal that fall outside the expected /users/{userId}/sendMail pattern.
Perform dependency scanning to identify Elixir projects pinned to swoosh versions from 1.12.0 through 1.26.2.

Monitoring Recommendations

Track Azure AD sign-in and Graph audit logs for anomalous endpoint usage by the application identity used by Swoosh.
Alert on any Graph API response codes or resource types that differ from the baseline of sendMail operations.
Monitor deployed dependency manifests (mix.lock) for outdated swoosh versions across build pipelines.

How to Mitigate CVE-2026-54893

Immediate Actions Required

Upgrade swoosh to version 1.26.3 or later in all Elixir applications using the Microsoft Graph adapter.
Audit application code for any path where a user-controlled value flows into email.from before Swoosh delivery.
Restrict the Microsoft Graph application permissions to the minimum scopes required for mail sending (for example Mail.Send only).

Patch Information

The fix is delivered in swoosh 1.26.3 via commit e38235453e81d1727bfc8d91e69ec4cb211ccf61. The adapter now percent-encodes the sender email using URI.encode/2 before interpolating it into the Graph API URL. See the GitHub Security Advisory GHSA-754j-98wh-57rf and the CNA advisory for full details.

Workarounds

Hardcode the from address in application configuration so it cannot be influenced by user input.
Validate and reject any sender address whose local part contains characters outside the standard [A-Za-z0-9._%+-] set before invoking Swoosh.
Reduce the Microsoft Graph token's scopes to Mail.Send only, limiting the blast radius if injection succeeds.

bash

# Update swoosh in mix.exs to the patched release
# {:swoosh, "~> 1.26.3"}
mix deps.update swoosh
mix deps.get
mix compile