Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning… (CVE-2026-107272)

Gophish through version 0.12.1 is affected by stored and reflected cross-site scripting vulnerabilities. Attackers who control or intercept the SMTP server used in a sending profile can craft malicious error messages that inject scripts. These scripts execute in the context of the administrator's browser when viewing campaign results or sending test emails, enabling theft of sensitive information such as API keys. The CVSS 3.1 base score is 4.7, indicating a low severity vulnerability with network attack vector, high attack complexity, no privileges required, user interaction required, and impact on confidentiality and integrity but not availability.

An attacker able to control or intercept SMTP server error messages can inject malicious scripts that execute in the administrator's browser. This can lead to theft of API keys, compromising the security of the Gophish environment. However, exploitation requires control or interception of SMTP server responses and user interaction by the administrator.

No official patch or fix information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should be cautious when interacting with SMTP servers and consider limiting exposure to untrusted SMTP servers. Monitoring for suspicious activity related to API keys is advisable.