Postal, the open source SMTP server, has a vulnerability that allows unescaped HTML to be injected in the admin message view. The issue arises when data passed through the API’s "send/raw" endpoint is rendered without proper sanitization, enabling an attacker to inject arbitrary HTML or JavaScript. This can modify the user interface in a misleading way or allow unauthorized script execution, representing a classic Cross‑Site Scripting flaw (CWE‑79).

Postal server versions prior to 3.3.5 are affected. The vulnerability is present in all generally available releases of Postal via the postalserver:postal product line and has been fixed in version 3.3.5 and later.

The CVSS score of 8.1 marks this vulnerability as high severity. The EPSS score is reported as less than 1 %, indicating low current exploit prevalence, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires sending a crafted payload through the public "send/raw" API endpoint, and success would result in HTML injection into the administrative interface for users who view the affected message. The attack vector is inferred from the description, as explicit details are not provided in the data.