CVE-2026-25529 - Vulnerability Analysis

Overview

Postal < 3.3.5 contains a stored XSS caused by unescaped data inclusion via the API's send/raw method in the admin interface, letting attackers execute arbitrary JavaScript, exploit requires API access.

Severity & Score

Impact

Attackers can execute arbitrary JavaScript in the admin interface, potentially leading to session hijacking or unauthorized actions.

Mitigation

Upgrade to version 3.3.5 or later.

References

• https://github.com/postalserver/postal/security/advisories/GHSA-5f4r-5jpr-rfhc

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 12, 2026

🟠 CVE-2026-25529 - High (8.1) Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" ... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-25529/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner