PT-2026-61662 · Mettle · Sendportal

CVE-2026-26483 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mettle SendPortal versions prior to 3.0.2

Description A stored cross-site scripting (XSS) issue exists in the template management functionality. The application does not properly sanitize user-supplied input in the content parameter of the '/templates' endpoint. This allows an attacker to persistently inject malicious JavaScript code, which is then executed in the browsers of users who view the affected template.

Recommendations Update Mettle SendPortal to version 3.0.2 or later. As a temporary mitigation, restrict access to the '/templates' endpoint or avoid using the content parameter until the update is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-26483

Affected Products

Sendportal

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-26483 · Security Note
• https://github.com/mettle/sendportal · Note
• https://gist.github.com/WinBlah12/8dbc1eae788945c6ea6ab1a2cdfd7cb1 · Note
• https://twitter.com/VulmonFeeds/status/2079386426081161676 · Twitter Post