Executive brief
Cypht is an email and contact management web application. A stored cross-site scripting (XSS) vulnerability in the contacts module allows attackers to inject malicious scripts via specially crafted email FROM headers. When a user views the email and accesses the Add Local Contacts function, the malicious script executes in their browser, potentially compromising account access and sensitive data.
Technical details
The vulnerability is a stored cross-site scripting flaw in Cypht's contacts module caused by incomplete input sanitization of the FROM email header. The sanitization logic removes only the first occurrence of angle bracket characters ('<' and '>'), allowing attackers to bypass the filter by including multiple angle brackets in the FROM header. An attacker can craft a malicious email with a FROM header containing script payloads (e.g., "Name <<script>...</script>>") that execute when the victim views the message and uses the Add Local Contacts function. The fix involves properly escaping FROM header values in the add-contact popup (commit 3723437). This vulnerability requires user interaction (opening the email and accessing the Add Local Contacts feature) but affects Cypht versions before 2.12.2.
Affected products
- Cypht Cypht before 2.12.2
Timeline
- 2026-09-01: disclosed
- 2026-08-28: patched: Fix merged in commit 3723437