CVE-2026-113583 Cypht 2.0.0 through 2.12.2 Stored DOM XSS via externalResources.js

Medium 5.3 Published 20 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-113583?

CVE-2026-113583 is a medium-severity vulnerability in cypht-org cypht, published on 20 Oct 2026.

Official description

Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers to execute arbitrary JavaScript by crafting malicious alt text or URL values in an HTML email's external image tag when ALLOW_EXTERNAL_IMAGE_SOURCES is enabled. Attackers can send a specially crafted email so that when the victim opens it, the externalResources.js code builds the blocked-image notice using innerHTML with decoded email-derived values, triggering script execution in the victim's authenticated session to read mailboxes, send email, or change settings.

Weakness: CWE-79

Which versions are affected by CVE-2026-113583?

How do I fix CVE-2026-113583?

No fix has been published for CVE-2026-113583 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-113583 being exploited?

There is no known exploitation of CVE-2026-113583 in the wild and no public exploit code.

Sources

Also known as GHSA-w69r-hqpc-72f2.