CVE-2025-70936 identifies a reflected XSS vulnerability in Vtiger CRM 8.4.0's MailManager module. The vulnerability is triggered by improper sanitization of the _folder parameter, which accepts user-controlled input. An attacker can craft a double URL-encoded payload that, when reflected, executes malicious scripts in the context of an authenticated user's session. This could potentially allow session hijacking or other client-side attacks if exploited. There is no information on patches or vendor advisories at this time.

The vulnerability allows execution of arbitrary scripts in the context of authenticated users, which can lead to session hijacking, unauthorized actions, or theft of sensitive information accessible to the user. However, there is no evidence of known exploits in the wild. The impact is limited to users who are authenticated and interact with the vulnerable MailManager module.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with links or inputs involving the _folder parameter in the MailManager module. Implementing web application firewall (WAF) rules to detect and block suspicious double URL-encoded payloads may provide temporary mitigation.