CVE-2026-73524

Name of the Vulnerable Software and Affected Versions Cypht versions prior to 2.12.2

Description A cross-site scripting issue exists in the contacts module. Remote attackers can execute arbitrary script content by embedding malicious payloads within angle brackets in the FROM email header. This occurs because the sanitization logic only removes the first occurrence of each angle bracket character, leaving subsequent brackets intact. An attacker can exploit this by sending a crafted email that executes scripts in the victim's browser when the user opens the message and uses the Add Local Contacts function.

Recommendations Update to version 2.12.2 or later.