Vtiger CRM 8.4.0 contains a reflected XSS vulnerability in the MailManager module due to improper sanitization of the _folder parameter. An attacker can craft a double URL-encoded payload that, when processed, is reflected back and executed in the browser context of an authenticated user, potentially leading to session hijacking or other client-side attacks. The vulnerability requires user interaction (UI:R) and privileges (PR:L) and affects confidentiality and integrity with no impact on availability.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of an authenticated user's session, potentially leading to theft of session tokens, user impersonation, or manipulation of client-side data. The impact is limited to confidentiality and integrity with no direct impact on system availability. No known active exploits have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution with untrusted input and consider applying web application firewall (WAF) rules to detect and block suspicious double URL-encoded payloads targeting the _folder parameter. Monitor vendor channels for official patches or updates.