PT-2026-30728 · Unknown · Stalwart Mail Server+1

Richardweinberger · CVE-2026-35390 · Published 2026-04-06 · Updated 2026-04-06

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Bulwark Webmail versions prior to 1.4.11

Description Bulwark Webmail, a self-hosted webmail client for Stalwart Mail Server, was affected by an issue where the reverse proxy (proxy.ts) incorrectly set the Content-Security-Policy-Report-Only header instead of the enforcing Content-Security-Policy header. This allowed cross-site scripting (XSS) attacks to be logged without being blocked. An attacker who could inject script content, such as through crafted email HTML, could execute arbitrary JavaScript in the application's context, potentially leading to session token theft or unauthorized actions performed on behalf of the user.

Recommendations Update Bulwark Webmail to version 1.4.11 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-35390

GHSA-6Q52-98CR-QX65

Affected Products

Bulwark Webmail

Stalwart Mail Server

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35390.json · Exploit
• https://github.com/bulwarkmail/webmail/security/advisories/GHSA-6q52-98cr-qx65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-35390 · Security Note
• https://osv.dev/vulnerability/CVE-2026-35390 · Vendor Advisory
• https://twitter.com/CVEnew/status/2041260648966029770 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041261103729041582 · Twitter Post