Open-Source Security Intelligence

Know every vulnerability
before it knows you.

DevGuard continuously monitors your dependencies and alerts you when CVEs like this one affect your stack — with real-time threat intelligence built for developers.

Checkout DevGuardView on GitHub
Search

GHSA-66m2-v9v9-95c3

CriticalCVSS 9.1 / 10
Published Mar 30, 2026·Last modified May 5, 2026
Affected Components(0)

No affected components available

Description

Summary

Vulnerability: Stored DOM XSS via System Settings – Mail Settings (Same-Page Attribute Breakout & Persistent Payload Injection)

  • Stored Cross-Site Scripting via Unsanitized Mail Settings Configuration Fields

Description

The application fails to properly sanitize user-controlled input within System Settings – Mail Settings. Several configuration fields, including Mail Server, Mail Port, Email Address, Email Password, Mail Protocol, and TLS settings, accept attacker-controlled input that is stored server-side and later rendered without proper output encoding.

Unlike public-facing XSS that executes on landing pages, this vulnerability executes immediately on the same settings page. The injected payload breaks out of the HTML attribute context and is interpreted by the browser when rendered, resulting in same-page DOM-based XSS.

This represents different functionality and a separate vulnerability from landing-page injection.

Example Affected Fields

  • Mail Server: test
  • Mail Port: 465
  • Email Address: simple@gmail.com
  • Email Password: (any input)
  • Mail Protocol: SMTP
  • Domain: simple@domain.com

Affected Functionality

  • System Settings – Mail Settings configuration
  • Same-page rendering of user-controlled input fields
  • DOM attribute injection within form inputs
  • Storage and retrieval of mail configuration values

Attack Scenario

  • An attacker injects a malicious JavaScript payload into one or more Mail Settings fields.
  • The payload breaks out of the HTML attribute context.
  • The application stores and re-renders the payload without sanitization or encoding.
  • The payload executes immediately on the same settings page.
  • The script executes in the browser context of the authenticated user managing Mail Settings.

Impact

  • Persistent Stored XSS
  • Immediate Same-Page DOM XSS execution
  • Execution of arbitrary JavaScript in victims’ browsers
  • Administrative privilege escalation
  • Full administrator account takeover
  • Full account takeover across all roles
  • Full compromise of the entire platform

Endpoints:

  • /backend/settings/ (Mail Settings)

Steps To Reproduce (POC)

  1. Navigate to System Settings -> Mail Settings
  2. Insert the following XSS payload into any Mail Settings field: test"><img src=1 onerror=alert()>" class="form-control" placeholder="Name" required>
  3. Save the settings
  4. Observe that the payload breaks out of the input attribute context
  5. The XSS executes immediately on the same page

Remediation

  • Never use .html() or any innerHTML-style sinks for user-controlled input in PHP or JavaScript.
  • Apply proper HTML encoding and input sanitization for all configuration fields.
  • Enforce CSP, HttpOnly, SameSite, and Secure flags for cookies to reduce the severity of XSS and potential CSRF escalation.
  • Audit all other system settings fields for similar attribute injection vulnerabilities.

Ready Video POC:

https://mega.nz/file/KRNhUI6Q#NGC3Bow3RlnmdU1H2bGu1BGbpfIc-awi6IlvTp08V1s

Risk Scores
Base Score
9.1

The vulnerability can be exploited over the network without needing physical access. It is easy for an attacker to exploit this vulnerability. An attacker needs high-level or administrative privileges. No user interaction is needed for the attacker to exploit this vulnerability. The vulnerability can affect other systems as well, not just the initial system. There is a high impact on the confidentiality of the information. There is a high impact on the integrity of the data. There is a high impact on the availability of the system.

Threat Intelligence
8.3

Exploitation activity has been observed. Apply available patches or mitigations urgently.

EPSS
0.36%

The exploit probability is very low. The vulnerability is unlikely to be exploited in the next 30 days.

Exploit
Not available

We did not find any exploit available. Neither in GitHub repositories nor in the Exploit-Database.

Browse More

Critical severity
Scan your project

Continuously monitor your dependencies and get alerted when vulnerabilities like this one affect your stack.

Checkout DevGuard