CVE Intelligence

Postalserver vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Postalserver products: 1 record(s), with severity, exploitation and fixes.

Postal 1

Exploited only (KEV) →

CVE-2026-25529 High · 8.1 CWE-79 Mar 12, 2026
Postal has HTML injection / XSS in message view
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be injected in to the page which may modify the page in a misleading way or allow for unauthorised javascript to be executed. Fixed in 3.3.5 and higher.