The vulnerability is a DOM‑based cross‑site scripting flaw that allows an attacker to inject and execute arbitrary JavaScript within the context of a victim’s authenticated webmail session. By placing malicious data inside the alt text or the URL of an external image tag in an HTML email, the front‑end code that builds the blocked‑image notice uses innerHTML with decoded email data, which triggers script execution. The exposed weakness matches CWE‑79, where undiscriminated user‑controlled input is injected into a DOM element.

The affected product is Cypht webmail, specifically versions 2.0.0 through 2.12.2. No other vendors or products are listed as affected.

The CVSS score of 5.3 indicates a moderate severity, and no EPSS score is available, so the current exploitation probability cannot be quantified. The flaw is not listed in the KEV catalog, so there are no recorded public exploits at this time. Attackers must craft a malicious email with an external image tag and the ALLOW_EXTERNAL_IMAGE_SOURCES setting must be enabled for the vulnerability to be exploitable. When a victim opens the email, the compromised script executes in the victim’s authenticated session, enabling actions such as reading mailboxes, sending messages, or modifying account settings.