CVE-2026-75872: MailerUp HTML Injection Vulnerability

CVE-2026-75872 Overview

CVE-2026-75872 is an HTML injection vulnerability in maalfer MailerUp before version 1.1.3. The flaw resides in the public subscription form, where the first_name field is interpolated unescaped into the double opt-in verification email. Unauthenticated remote attackers can trigger the application to send messages carrying arbitrary HTML to an attacker-chosen recipient address. The messages originate from the form owner's configured sending identity, enabling abuse of the sender's mail reputation for phishing and social engineering. The vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).

Critical Impact
Unauthenticated attackers can weaponize the form owner's mail sending identity to distribute arbitrary HTML content to victims of their choosing.

Affected Products

maalfer MailerUp versions before 1.1.3
MailerUp public subscription form component (backend/apps/forms/views.py)
MailerUp double opt-in email delivery workflow

Discovery Timeline

2026-08-18 - CVE CVE-2026-75872 published to NVD
2026-08-18 - Last updated in NVD database

Technical Details for CVE-2026-75872

Vulnerability Analysis

MailerUp is an email marketing platform that offers public subscription forms with a double opt-in workflow. When a visitor submits the subscription form, the backend generates a verification email containing a personalized greeting. The first_name field submitted through the form is embedded directly into the HTML body of that verification email without escaping. An attacker submits a form request containing an arbitrary email address as the recipient and a first_name value that includes attacker-controlled HTML markup. MailerUp then delivers a message from the form owner's authenticated sending identity to the attacker-supplied address, carrying whatever HTML the attacker chose. The result is unauthenticated, one-click abuse of legitimate mail infrastructure for phishing lures, malicious links, and brand impersonation.

Root Cause

The root cause is missing output encoding in the _verification_email_html function within backend/apps/forms/views.py. The function used f-string interpolation to inject form_obj.title, form_obj.primary_color, and the subscriber-supplied greeting directly into the email HTML. Because the greeting embeds the unauthenticated first_name field, attacker input reached the rendered HTML verbatim.

Attack Vector

Exploitation requires only network access to the public subscription form. No authentication and no user interaction on the target's endpoint are needed to trigger email delivery. The attacker chooses both the recipient address and the HTML payload, and the email arrives from the form owner's legitimate sending identity, defeating naive sender-based trust checks.

python

# Security patch: escaping first_name / title / color in the double opt-in email
# Source: https://github.com/maalfer/mailerup/commit/da4aedc9621911df4ce0cc8f0b321dd6d10f40a5

def _verification_email_html(form_obj, greeting, verify_url):
    """Returns the HTML body for the double-opt-in verification email.

    `greeting` must already be HTML-escaped by the caller (it embeds the
    unauthenticated subscriber-supplied first_name); form_obj.title and
    primary_color are form-owner-controlled but escaped/validated here too,
    same as _build_embed_html, since this HTML is emailed out verbatim.
    """
    safe_title = escape(form_obj.title)
    color = _safe_color(form_obj.primary_color)
    return f"""<!doctype html>
<html><head><meta charset="utf-8"></head>
<body style="font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',sans-serif;background:#f8fafc;margin:0;padding:20px">
<div style="max-width:520px;margin:0 auto;background:#fff;border-radius:12px;padding:36px;border:1px solid #e2e8f0">
  <h2 style="margin:0 0 8px;color:#111827">{safe_title}</h2>
  <p style="color:#374151;margin:0 0 24px">{greeting} Por favor confirma tu suscripcion haciendo clic en el boton:</p>
  <p style="text-align:center;margin:0 0 24px">
    <a href="{verify_url}" style="display:inline-block;padding:12px 28px;background:{color};color:#fff;text-decoration:none;border-radius:8px;font-weight:600;font-size:15px">
      Confirmar suscripcion
    </a>
  </p>

The patch introduces escape(form_obj.title) and _safe_color(form_obj.primary_color), and requires callers to HTML-escape the greeting containing first_name before it reaches this function.

Detection Methods for CVE-2026-75872

Indicators of Compromise

Subscription form submissions where the first_name field contains HTML tags such as <a>, <img>, <script>, or inline style= attributes.
Outbound verification emails delivered to recipient addresses that never appear in legitimate marketing lists or CRM data.
Unusually high volumes of double opt-in messages sent within short time windows from a single form endpoint.

Detection Strategies

Log every subscription request server-side and alert on non-alphabetic characters, angle brackets, or URL patterns inside the first_name field.
Correlate outbound SMTP logs with subscription form submissions to identify verification emails sent to addresses that did not originate from opt-in campaigns.
Deploy web application firewall (WAF) rules that block HTML tag patterns in name fields on the public MailerUp subscription endpoint.

Monitoring Recommendations

Monitor mail server bounce rates and abuse complaints tied to the MailerUp sending identity for sudden spikes.
Track the MailerUp application version reported by the API and alert on any instance still running below 1.1.3.
Review email service provider (ESP) reputation dashboards for blocklistings that could indicate abuse of the sender identity.

How to Mitigate CVE-2026-75872

Immediate Actions Required

Upgrade all MailerUp deployments to version 1.1.3 or later, which is published at GitHub Release v1.1.3.
Audit outbound email logs for verification messages sent to addresses that do not match legitimate subscribers and notify affected recipients if abuse is confirmed.
Rotate any DKIM keys or sending credentials if evidence indicates the mail sending identity was abused at scale.

Patch Information

The upstream fix is delivered in the commit da4aedc9621911df4ce0cc8f0b321dd6d10f40a5, which HTML-escapes first_name, title, and validates primary_color before interpolation into the double opt-in email body. The application VERSION string was bumped from 1.1.2 to 1.1.3 in backend/mailerup/settings/base.py. Additional analysis is available in the CNA CVE-2026-75872 Analysis.

Workarounds

Place the public subscription endpoint behind a WAF rule that rejects submissions where first_name contains <, >, or href= substrings.
Enforce strict server-side validation limiting first_name to a short allowlist of Unicode letters, spaces, hyphens, and apostrophes.
Rate-limit subscription submissions per source IP address to reduce mass abuse of the double opt-in mailer.

bash

# Example nginx configuration blocking HTML metacharacters in first_name and rate-limiting the endpoint
limit_req_zone $binary_remote_addr zone=mailerup_sub:10m rate=5r/m;

server {
    location /api/forms/subscribe {
        limit_req zone=mailerup_sub burst=5 nodelay;

        if ($request_body ~* "first_name=[^&]*(<|>|href=|script)") {
            return 400;
        }

        proxy_pass http://mailerup_backend;
    }
}