CVE-2026-129169

CVSS 5.4 (medium) · published 2026-11-13

PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by sending unsanitized HTML through /api/email/send. Attackers can embed event-handler payloads like img onerror that execute when administrators view the message, enabling privileged API calls such as password changes for account takeover.

Weakness: CWE-79

Source: NVD CVE-2026-129169

References

• https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/fe/src/views/EmailDetailView.vue#L52
• https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/controllers/email/send.go#L144-L184
• https://github.com/Jinnrry/PMail/blob/d6815e481c72dc142ebfa478456f4a0e6c069097/server/services/detail/detail.go#L20-L29
• https://github.com/Jinnrry/PMail/issues/371
• https://vul.yulun.ac.cn/20261027/pmail/
• https://www.vulncheck.com/advisories/pmail-2.5.0-through-2.9.8-stored-xss-via-api-email-send-html-body

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.