CVE-2026-103647— Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer
Quick assessment
Affected
Progressive Robot Ltd hMailServer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progressive Robot 公司开发的 hMailServer 6.3.2 至 6.3.5 版本中，其 Webmail 组件存在跨站脚本（XSS）漏洞。该漏洞允许能够向用户发送加密邮件的远程攻击者在用户的 Webmail 会话上下文中执行恶意脚本。 当 Webmail 在浏览器中解密 S/MIME 邮件（影响 6.3.2 版本）或 OpenPGP 邮件（影响 6.3.4 及以上版本）时，它会将每个解密后的附件以媒体类型声明的 Blob URL 形式提供。如果用户点击该附件，文件会被保存；但如果用户在浏览器新
Possible ATT&CK Techniques 3 AI
T1210 · Exploitation of Remote Services T1059.007 · JavaScript T1189 · Drive-by Compromise
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-103647
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in hMailServer
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progressive Robot Ltd | hMailServer | 6.3.2 ~ 6.3.6 | - |
|
II. Public POCs for CVE-2026-103647
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-103647
请登录查看更多情报信息。
Other References for CVE-2026-103647 (2)
Same Patch Batch · Progressive Robot Ltd · 2026-10-08 · 22 CVEs total
| CVE-2026-103010 | 7.8 HIGH | Heap-based Buffer Overflow in hMailServer |
| CVE-2026-104660 | 7.8 HIGH | Missing Authorization in hMailServer |
| CVE-2026-104658 | 7.8 HIGH | Reliance on Untrusted Inputs in a Security Decision in hMailServer |
| CVE-2026-107573 | 7.8 HIGH | Incorrect Default Permissions in hMailServer |
| CVE-2026-107577 | 7.5 HIGH | Loop with Unreachable Exit Condition ('Infinite Loop') in hMailServer |
| CVE-2026-107574 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107579 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107576 | 7.5 HIGH | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-104659 | 7.5 HIGH | Origin Validation Error in hMailServer |
| CVE-2026-103649 | 7.5 HIGH | Synchronous Access of Remote Resource without Timeout in hMailServer |
| CVE-2026-107584 | 7.4 HIGH | Not Failing Securely ('Failing Open') in hMailServer |
| CVE-2026-104704 | 7.4 HIGH | Cleartext Transmission of Sensitive Information in hMailServer |
| CVE-2026-107578 | 6.7 MEDIUM | Improper Link Resolution Before File Access ('Link Following') in hMailServer |
| CVE-2026-107583 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107572 | 6.5 MEDIUM | Inefficient Regular Expression Complexity in hMailServer |
| CVE-2026-107581 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107582 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-107580 | 6.5 MEDIUM | Inefficient Algorithmic Complexity in hMailServer |
| CVE-2026-103011 | 6.5 MEDIUM | Heap-based Buffer Overflow in hMailServer |
| CVE-2026-107587 | 5.9 MEDIUM | Improper Certificate Validation in hMailServer |
Showing top 20 of 22 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: hMailServer
-
CVE-2026-107584
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-107583
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107587
Improper Certificate Validation in hMailServer -
CVE-2026-107582
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107581
Inefficient Algorithmic Complexity in hMailServer
Same vendor: Progressive Robot Ltd
-
CVE-2026-107584
Not Failing Securely ('Failing Open') in hMailServer -
CVE-2026-107583
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107587
Improper Certificate Validation in hMailServer -
CVE-2026-107582
Inefficient Algorithmic Complexity in hMailServer -
CVE-2026-107581
Inefficient Algorithmic Complexity in hMailServer
Same weakness: CWE-79
-
CVE-2026-27420
WordPress Zotpress plugin <= 7.4.4 - Cross Site Scripting (X -
CVE-2026-62127
WordPress WP plugin Info Card plugin <= 6.3.5 - Cross Site S -
CVE-2026-105079
WordPress MasterStudy LMS plugin <= 3.7.52 - Cross Site Scri -
CVE-2026-105890
WordPress Gutenberg Blocks by Kadence Blocks plugin <= 3.7.1 -
CVE-2026-105078
WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scri
V. Comments for CVE-2026-103647
No comments yet