Executive brief
Mettle SendPortal, an open-source email marketing platform, contains a security flaw in its template management system. An attacker with access to create or edit email templates can inject malicious scripts that will run in the browsers of other users who view those templates. This could lead to unauthorized access to user accounts, theft of session information, or the performance of actions on behalf of other administrators.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Mettle SendPortal versions 3.0.1 and earlier. The vulnerability is located in the template management functionality, specifically within the 'content' parameter of the /templates endpoint. The application fails to properly sanitize user-supplied input or encode output when rendering these templates. An authenticated attacker can inject arbitrary JavaScript code that is persistently stored on the server. When other users (such as administrators) view the affected template, the malicious script executes in their browser context, potentially allowing for session hijacking or privilege escalation.
Affected products
- Mettle SendPortal 3.0.1 and earlier
Timeline
- 2026-06-22: disclosed: Initial discovery and Gist publication
- 2026-07-20: advisory: CVE published to NVD