CVE-2026-104083

Name of the Vulnerable Software and Affected Versions SmarterMail versions prior to build 9777

Description A stored mutation cross-site scripting issue exists where remote attackers can inject executable scripts. This occurs by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer incorrectly treats as inert CDATA text while browsers reparse it as live markup. An attacker can send a crafted calendar (iCal) message containing an <img src=x onerror=...> payload. This script executes automatically in the recipient's webmail session at the /interface/message-iframe endpoint when the message is opened, allowing for script execution and data exfiltration due to a permissive Content-Security-Policy.

Recommendations Update SmarterMail to build 9777 or later.