CVE-2026-103647

Summary

A cross-site scripting vulnerability in Progressive Robot hMailServer's webmail allows remote attackers to execute scripts in the context of a user's session when they open decrypted email attachments. This occurs because the webmail renders text/html attachments as documents from the webmail's origin, enabling script execution that can access the user's mailbox and perform actions through the REST API.

Exploitability

Exploitation requires sending an encrypted message containing a malicious HTML attachment to a target user, with the user opening it in a new tab; the attack is moderately difficult due to the need for user interaction but doesn't require authentication or privileged access.

Blast radius

The impact is significant as attackers could read all emails, send messages, and modify account settings on behalf of any user who opens the malicious attachment, particularly affecting users with REST API enabled.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Disable the REST API in hMailServer configuration until a patch is available, or upgrade to version 6.3.6 which fixes this vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.