Vulnerability · Published Sep 1, 2026 · Assigned by VulnCheck
CVE-2026-73524Cypht < 2.12.2 XSS via FROM Email Header in Contacts Module
Medium 6.1
In plain English
A medium-severity cross-site scripting in cypht from cypht-org. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).
Official description
Cypht before 2.12.2 contains a cross-site scripting vulnerability in the contacts module that allows remote attackers to execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. The sanitization logic removes only the first occurrence of each angle bracket character, leaving additional angle brackets intact, which attackers exploit by delivering a crafted email whose FROM header executes script in the victim's browser when the user opens the message and accesses the Add Local Contacts function.
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- Release Notes release-notes
- Pull Request issue-tracking
- Patch Commit patch
- https://www.vulncheck.com/advisories/cypht-xss-via-from-email-header-in-contacts-module third-party-advisory