PT-2026-25008 · Git+1 · Postal

Adamcoke · Published 2026-03-12 · Updated 2026-03-12 · CVE-2026-25529

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Postal versions prior to 3.3.5

Description Postal is an open source SMTP server. Versions prior to 3.3.5 contain a HTML injection issue that allows unescaped data to be included in the administration interface. The primary method for adding unescaped data is through the send/raw method of the API endpoint /api/v1/send/raw. This could allow arbitrary HTML to be injected into the page, potentially modifying the page in a misleading way or enabling the execution of unauthorized javascript.

Recommendations Upgrade to Postal version 3.3.5 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25529

GHSA-5F4R-5JPR-RFHC

Affected Products

Postal

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25529.json · Exploit
• https://github.com/postalserver/postal/security/advisories/GHSA-5f4r-5jpr-rfhc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25529 · Security Note
• https://osv.dev/vulnerability/CVE-2026-25529 · Vendor Advisory
• https://twitter.com/CVEnew/status/2032230709981577289 · Twitter Post
• https://twitter.com/TheHackerWire/status/2032151384007872548 · Twitter Post
• https://t.me/CVEtracker/47267 · Telegram Post