Description

Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-09-01T21:18:36.463Z",
  "pubdate": "2026-09-01T21:18:36.463Z",
  "executiveSummary": "Cypht versions prior to 2.12.2 are susceptible to a stored cross-site scripting (XSS) vulnerability residing within the contacts module.\nThe flaw allows remote attackers to inject malicious JavaScript payloads via the 'FROM' email header.\nSuccessful exploitation occurs when a victim accesses the 'Add Local Contacts' function after opening a crafted email containing the malicious payload.\nThe vulnerability stems from flawed sanitization logic that insufficiently handles angle bracket characters, leading to script execution within the victim's session.\nAn attacker can leverage this to execute arbitrary code, potentially leading to session hijacking, unauthorized actions, or data exfiltration within the context of the authenticated user's browser.\nThis vulnerability requires no specific authentication on the part of the attacker, as it is triggered through the delivery of an email message.\nThe impact is significant, as it compromises the integrity of the user's browser session and provides a vector for client-side attacks.",
  "technicalDetails": "The vulnerability exists in the contacts module of Cypht versions prior to 2.12.2 and is classified as a stored XSS condition. The root cause is a deficiency in the input sanitization logic responsible for processing email metadata, specifically the 'FROM' header.\nThe application attempts to neutralize potential XSS vectors by filtering angle brackets ('<' and '>') that are commonly used to define HTML tags. However, the sanitization mechanism is implemented in a non-recursive manner, specifically removing only the first occurrence of these characters while leaving subsequent instances intact.\nAn attacker can circumvent this filter by crafting an email where the 'FROM' header contains nested or multiple angle brackets. By embedding a payload such as '<<script>alert(1)</script>', the initial sanitization process removes only the first leading bracket, leaving behind a functional '<script>alert(1)</script>' sequence.\nThe attack flow proceeds as follows: First, the attacker sends an email to the victim with a malicious, payload-injected 'FROM' header. Second, the email is parsed and stored by the Cypht system. Third, the victim opens the malicious email within the Cypht interface. Finally, when the victim navigates to the 'Add Local Contacts' function, the application processes the stored, unsanitized header and reflects the malicious payload into the Document Object Model (DOM) of the victim's browser session.\nBecause the payload is injected into the DOM within the victim's authenticated session, the malicious script executes with the same privileges as the victim. This enables the attacker to perform actions on behalf of the user, such as modifying contacts, accessing sensitive information, or initiating further malicious requests within the web application.\nThis vulnerability is particularly dangerous because it does not require the attacker to have direct access to the application's infrastructure; the malicious content is delivered through standard mail protocols. The lack of proper contextual encoding or recursive sanitization in the contacts module exposes users to unauthorized script execution whenever they interact with processed email metadata."
}