GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies processed by the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.

GestSup (GestSup) application, all releases before 3.2.61, as documented by the vendor’s changelog and patch releases.

The vulnerability carries a CVSS score of 5.3, indicating moderate risk. The EPSS score is <1%, suggesting a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated email sent to the mailbox monitored by the IMAP connector; the exploit requires only the ability to inject an email and a technician to open the resulting ticket.