Threats tagged 'ghsa-744c-9r45-5f92'

PMail versions 2.9.1 through 2.9.8 have a stored cross-site scripting (XSS) vulnerability in the /attachments/{id}/{cid} endpoint. This endpoint returns email attachments with the sender-supplied Content-Type after rewriting cid references into attachment links. Unauthenticated SMTP senders can exploit this by sending a text/html attachment and a page-covering cid link, causing the recipient's webmail session to execute malicious scripts, potentially allowing password changes including for administrators.