CVE-2026-103647: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Progressive Robot Ltd hMailServer

This vulnerability involves improper neutralization of input during web page generation (CWE-79) in hMailServer's webmail. When the webmail decrypts S/MIME messages (from version 6.3.2) or OpenPGP messages (from 6.3.4), it presents decrypted attachments as blob URLs with the media type declared by the message. If a user opens an attachment declared as text/html in a new tab, the script executes in the webmail's origin context, allowing the attacker to read mailbox contents, send mail, and modify the account via the REST API. The vulnerability affects versions 6.3.2 through 6.3.5 inclusive and requires the REST API to be enabled, which is off by default.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the victim's webmail session, leading to full compromise of mailbox contents, unauthorized sending of emails, and modification of the user account through the REST API. This can result in data theft, account takeover, and unauthorized actions performed on behalf of the user. The attack requires user interaction (opening a malicious attachment) and the REST API enabled on the server.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, ensure the REST API is disabled if not required, since the webmail is only served when the REST API is enabled. Users should be cautious when opening decrypted attachments, especially those declared as text/html. Monitor vendor communications for updates and apply any official fixes once available.