VYPR
← All advisories
High severity8.1NVD Advisory· Published Mar 12, 2026· Updated Jun 17, 2026

CVE-2026-25529

CVE-2026-25529

Description

Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be injected in to the page which may modify the page in a misleading way or allow for unauthorised javascript to be executed. Fixed in 3.3.5 and higher.

Affected products

3
  • Postalserver/Postal2 versions
    cpe:2.3:a:postalserver:postal:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:postalserver:postal:*:*:*:*:*:*:*:*range: <3.3.5
    • (no CPE)range: < 3.3.5
  • Postal/Postalllm-fuzzy
    Range: <3.3.5

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.