CVE-2026-73524 Overview
Cypht before version 2.12.2 contains a stored cross-site scripting vulnerability [CWE-79] in the contacts module. Remote attackers can execute arbitrary JavaScript by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic in the Add Local Contacts function removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact. When a victim opens a crafted email and invokes the Add Local Contacts function, the attacker payload executes in the victim's browser context.
Critical Impact
Attackers can execute arbitrary script in the victim's browser session by sending a crafted email, enabling session data theft, mailbox manipulation, and further client-side attacks against Cypht webmail users.
Affected Products
- Cypht webmail versions prior to 2.12.2
- Cypht contacts module (modules/contacts/site.js)
- Self-hosted Cypht IMAP/SMTP webmail deployments
Discovery Timeline
- 2026-09-01 - CVE-2026-73524 published to NVD
- 2026-09-01 - Last updated in NVD database
Technical Details for CVE-2026-73524
Vulnerability Analysis
The vulnerability resides in the client-side JavaScript that renders contact information when a user clicks Add Local Contacts. Cypht parses the FROM header of a displayed email to extract the sender's name and email address. The extracted values flow directly into an HTML template literal without proper output encoding.
The attempted sanitization strips angle brackets from the raw header, but the implementation only removes the first < and > encountered. Attackers who supply multiple angle brackets bypass the filter and inject a working <script> or event-handler payload. Because the payload persists in a stored contact record and executes in the authenticated user's browser, the impact extends to any session state accessible to Cypht's frontend.
Root Cause
The root cause is unsafe interpolation of untrusted email header data into an HTML template string combined with an incomplete sanitizer. The fix replaces the raw string interpolation with jQuery text-node encoding, ensuring the value is treated as text rather than markup regardless of how many angle brackets it contains.
Attack Vector
Exploitation requires no authentication on the attacker side. The attacker sends an email with a malicious FROM header to a Cypht user. When the victim opens the message and clicks Add Local Contacts, the injected script executes under the Cypht origin. User interaction is required, which limits scale but not effectiveness in targeted scenarios.
// Security patch in modules/contacts/site.js
// Merge pull request #2072 from IrAlfred/fix-stored-xss-from-header
var name = contact.replace(EMAIL_REGEX, "");
var saveContactContent = `<div><table>
- <tr><td><strong>${hm_trans('Name')} :</strong></td><td>${name}</td></tr>
- <tr><td><strong>${hm_trans('Email')} :</strong></td><td>${email}</td></tr>
+ <tr><td><strong>${hm_trans('Name')} :</strong></td><td>${$('<span>').text(name).html()}</td></tr>
+ <tr><td><strong>${hm_trans('Email')} :</strong></td><td>${$('<span>').text(email).html()}</td></tr>
<tr><td><strong>${hm_trans('Source')} :</strong></td><td>Local</td></tr>
</table></div>`
Source: GitHub Commit 3723437. The patch wraps each interpolated value with $('<span>').text(value).html(), which forces jQuery to HTML-encode the string before insertion.
Detection Methods for CVE-2026-73524
Indicators of Compromise
- Inbound emails whose FROM header contains multiple < or > characters, HTML tags, or on*= event-handler attributes
- Cypht contact records containing raw HTML markup, <script> tags, or JavaScript URI schemes in the name or email fields
- Unexpected outbound requests from Cypht webmail sessions to attacker-controlled domains shortly after opening a message
Detection Strategies
- Inspect mail gateway logs for FROM headers that deviate from RFC 5322 addr-spec syntax, particularly headers containing angle brackets beyond the standard email delimiters
- Review the Cypht contacts store for entries whose name or email fields include HTML tags or JavaScript event handlers
- Correlate browser telemetry with Cypht page loads to identify script execution originating from contact rendering paths
Monitoring Recommendations
- Enable Content Security Policy reporting on the Cypht origin to capture inline script violations tied to this class of injection
- Log and alert on authenticated Cypht sessions that trigger unexpected DOM modifications or outbound XHR to non-allowlisted hosts
- Track deployed Cypht versions across the environment and flag any instance running below 2.12.2
How to Mitigate CVE-2026-73524
Immediate Actions Required
- Upgrade all Cypht instances to version 2.12.2 or later, which contains the sanitization fix from pull request #2072
- Audit existing local contact records for stored HTML or script content and purge malicious entries
- Notify Cypht users to avoid adding contacts from unsolicited or unexpected messages until patching is confirmed
Patch Information
The fix is available in the Cypht v2.12.2 release and merged through Pull Request #2072. Additional advisory details are available in the VulnCheck XSS Advisory.
Workarounds
- Deploy a strict Content Security Policy on the Cypht origin that disallows inline scripts and restricts script sources to trusted hosts
- Configure the upstream mail gateway to reject or rewrite messages whose FROM header contains unexpected angle brackets or HTML markup
- Restrict use of the Add Local Contacts function through administrative guidance until the upgrade is deployed
# Example: verify Cypht version and pull the patched release
git -C /opt/cypht describe --tags
git -C /opt/cypht fetch --tags
git -C /opt/cypht checkout v2.12.2
# Example: strict CSP header for the Cypht virtual host (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none';" always;
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
