PT-2025-26486 · Unknown · Mail-0'S Zero

Embeddinglayer · Published 2025-06-21 · Updated 2025-06-21 · CVE-2025-52557

Positive Technologies (AI Summary)

CVSS v4.0

8.6

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions: Mail-0's Zero versions 0.8

Description: The issue is related to improper sanitization, allowing an attacker to craft an email that executes javascript, leading to session hijacking. This is a Stored XSS Vulnerability in the Mail-0's Zero Email Solution.

Recommendations: For version 0.8, update to version 0.81 to resolve the issue. As a temporary workaround, consider disabling javascript execution in emails until the patch is applied. Restrict access to sensitive email accounts to minimize the risk of session hijacking.

Exploit

Fix

Weakness Enumeration

CWE-1384

Related Identifiers

CVE-2025-52557

GHSA-34GH-G567-HQ85

Affected Products

Mail-0'S Zero

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/52xxx/CVE-2025-52557.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-52557 · Security Note
• https://osv.dev/vulnerability/CVE-2025-52557 · Vendor Advisory
• https://github.com/Mail-0/Zero/commit/48d1df65b62c9c57897b72b241081f447140342f · Note
• https://github.com/Mail-0/Zero/pull/1386 · Note
• https://github.com/Mail-0/Zero/security/advisories/GHSA-34gh-g567-hq85 · Note
• https://twitter.com/VulmonFeeds/status/1936320728971772400 · Twitter Post
• https://t.me/latest_high_impact_cve/2748 · Telegram Post
• https://twitter.com/CVEnew/status/1936472503746003023 · Twitter Post
• https://t.me/cvenotify/126331 · Telegram Post
• https://t.me/cvetracker/26728 · Telegram Post