cypht-org vulnerabilities and threats

Cypht webmail versions 2.0.0 through 2.12.2 have a DOM-based cross-site scripting (XSS) vulnerability. This flaw allows remote attackers to execute arbitrary JavaScript by sending specially crafted emails containing malicious alt text or URL values in external image tags when the ALLOW_EXTERNAL_IMAGE_SOURCES setting is enabled. Exploitation occurs when the victim opens the email, triggering script execution in their authenticated session. This can lead to unauthorized mailbox reading, email sending, or settings modification.

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back_query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload through this parameter, which is decoded and passed directly to unserialize() without an allow-list, signature check, or type restriction, enabling gadget-chain exploitation to achieve remote code execution as the web server process.