Threats affecting pkg:github/PMail

PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid: references into attachment links. An unauthenticated SMTP sender can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious script, potentially allowing password changes including for administrators.

Jinnrry PMail versions 2.5.0 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability. Authenticated users can inject malicious scripts via the /api/email/send endpoint by sending unsanitized HTML. These scripts can execute when administrators view the crafted messages, potentially allowing attackers to perform privileged API actions such as changing passwords and taking over accounts.