hMailServer: Cross-site scripting in webmail via decrypted attachments
Summary
The bundled webmail of hMailServer 6.3.2 to 6.3.5 can run attacker-supplied script in the webmail's origin. When the webmail decrypts an S/MIME or OpenPGP message in the browser, an attachment declared as text/html runs its script if the user opens it in a new tab. The script can then read the mailbox, send mail and change the account through the REST API. The webmail is only served when the REST API is enabled, which is not the default, and the attacker must send an encrypted message while the user must open the attachment in a new tab. The CNA rates the issue CVSS 8.0 (High), VulDB 4.3 (Medium).
Affected
- hMailServer 6.3.2 to 6.3.5 (S/MIME decryption from 6.3.2, OpenPGP decryption from 6.3.4)
- Only installations with the REST API and webmail enabled (RestApiPort not 0); the default is off
Fixed in
- Upgrade to hMailServer 6.3.6 (vendor fix)
- Check the vendor's GitLab project for the newest release
Workaround
- Keep the REST API disabled (RestApiPort 0, the default), which also disables the webmail
- Tell webmail users not to open decrypted attachments in a new tab and to use a desktop mail client for encrypted mail
Exploitation
- No known exploitation in the wild and no public proof of concept found at the time of research
- CISA SSVC: exploitation none, not automatable
- Not listed in CISA KEV as of the last check
Our recommendation
- Upgrade to 6.3.6 at minimum, or to the newest release from the vendor's GitLab project
- Check whether the webmail and REST API are enabled on your hMailServer instances
- If they are, prioritise the upgrade and restrict access to the REST API
- Inform webmail users about the risk of opening decrypted attachments in a new tab
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- hMailServer 6.3.6 release (GitLab) gitlab.com
- Webmail decrypted attachment issue #52 (GitLab) gitlab.com
- OSV: CVE-2026-103647 osv.dev
- VulDB: CVE-2026-103647 vuldb.com
- OffSeq Radar: CVE-2026-103647 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:31.
Original description (NVD)
Cross-site scripting in the webmail of Progressive Robot hMailServer 6.3.2 through 6.3.5 allows a remote attacker who can send a user an encrypted message to run script in the webmail's origin with that user's session. When the webmail decrypted an S/MIME message (from 6.3.2) or an OpenPGP message (from 6.3.4) in the browser, it offered each decrypted attachment as a blob URL of the media type the message declared for it. A click saved the file, but if the user opened the attachment in a new tab, a part declared as text/html was rendered as a document of the webmail's origin and its script could read the mailbox, send mail and change the account through the REST API. The webmail is served only when the REST API is enabled, which it is not by default.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.