MEDIUM 收录于 2026-10-10 00:17

CVE-2026-104083 SmarterMail 存储型变异 XSS 漏洞

影响攻击者可在收件人 Webmail 会话中执行任意脚本并窃取数据

6.1 CVSS

MEDIUM

AI 研判

SmarterMail build 9777 之前版本存在存储型变异 XSS 漏洞。攻击者通过构造包含 MathML 外来内容（<math><mtext>）嵌套载荷的 iCal 日历消息，绕过自定义 HTML 清洗器。当收件人打开该消息时，脚本在 /interface/message-iframe 中自动执行。

影响范围

SmarterMail

SmarterMail build 9777 之前的版本受影响，具体版本范围以官方公告为准。

漏洞详情

漏洞属于存储型变异 XSS（mXSS）。清洗器将 <math><mtext> 内的内容视为惰性 CDATA 文本，但浏览器重新解析时将其当作活动标记，导致 <img src="x"> 等载荷被激活执行。攻击者只需发送特制 iCal 日历消息，收件人打开即触发。

利用条件与风险

利用需受害者打开恶意日历消息，无需其他交互；由于界面 CSP 较为宽松，脚本可执行并外传数据，实战风险中等。

修复建议

升级至 SmarterMail build 9777 或更高版本；暂无公开临时缓解措施，可考虑对日历消息内容进行额外过滤或收紧 CSP。

原始情报

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a element nested within MathML foreign content ( $), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing anpayload that executes automatically in the recipient’s webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface’s permissive Content-Security-Policy.6.1 CVSS MEDIUM 情报档案编号 CVE-2026-104083 CVSS 6.1 来源 NVD 收录 2026-10-10 00:17 参考链接 www.smartertools.com/smartermail/release-notes/current#/9526:~:text=Build%209777%20(Oct%208%2C%202026) www.vulncheck.com/advisories/smartermail-build-9777-stored-mutation-xss-via-mathml-foreign-content 查看原始通告 ↗ ← 返回情报板← Google Guava 反序列化拒绝服务漏洞 AWS Tools for PowerShell 日志敏感信息泄露漏洞 →辽ICP备2022007138号 Built by manta0 · Powered by 白泽(function () {
// 亮暗主题切换：持久化到 localStorage；图标显隐交给 CSS，切换时按钮尺寸不跳动
var toggle = document.querySelector('.bz-theme-toggle');
if (toggle) {
var root = document.documentElement;
toggle.addEventListener('click', function () {
var next = root.getAttribute('data-theme') === 'light' ? 'dark' : 'light';
root.setAttribute('data-theme', next);
try { localStorage.setItem('bz-theme', next); } catch (e) {}
});
}
// 数字滚动计数（easeOutCubic，无 JS 时显示 PHP 输出的真实值）
document.querySelectorAll('[data-count]').forEach(function (el) {
var target = parseInt(el.dataset.count, 10) || 0, t0 = null, dur = 900;
function step(ts) {
if (!t0) t0 = ts;
var p = Math.min((ts - t0) / dur, 1);
p = 1 - Math.pow(1 - p, 3);
el.textContent = Math.round(target * p).toLocaleString();
if (p < 1) requestAnimationFrame(step);
}
el.textContent = '0';
requestAnimationFrame(step);
});
// 滚动揭示：JS 注入 .reveal，无 JS 时内容正常显示
if ('IntersectionObserver' in window) {
var io = new IntersectionObserver(function (entries) {
entries.forEach(function (e) {
if (e.isIntersecting) { e.target.classList.add('in'); io.unobserve(e.target); }
});
}, { threshold: 0.12 });
document.querySelectorAll('.can-reveal').forEach(function (el) {
el.classList.add('reveal');
io.observe(el);
});
}
})();{"prefetch":[{"source":"document","where":{"and":[{"href_matches":"/*"},{"not":{"href_matches":["https://baize.geektoast.cn/storage/*","https://baize.geektoast.cn/core/*","https://baize.geektoast.cn/core/modules/*","https://baize.geektoast.cn/core/views/cb3f170c99/*","/*\\?(.+)"]}},{"not":{"selector_matches":"a[rel~=\"nofollow\"]"}},{"not":{"selector_matches":".no-prefetch, .no-prefetch a"}}]},"eagerness":"conservative"}]}{"baseUrl":"https://s.w.org/images/core/emoji/17.0.2/72x72/","ext":".png","svgUrl":"https://s.w.org/images/core/emoji/17.0.2/svg/","svgExt":".svg","source":{"concatemoji":"https://baize.geektoast.cn/lib/js/wp-emoji-release.min.js?rnd=27009"}}/*! This file is auto-generated */
var e="script#wp-emoji-settings",t=document.querySelector(e);if(!(t instanceof HTMLScriptElement))throw new Error("Element missing: "+e);const r=JSON.parse(t.text),s=(window._wpemojiSettings=r,"wpEmojiSettingsSupports"),o=["flag","emoji"];function i(e){try{var t={supportTests:e,timestamp:(new Date).valueOf()};sessionStorage.setItem(s,JSON.stringify(t))}catch(e){}}function c(e,t,n){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);t=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(n,0,0);const r=new Uint32Array(e.getImageData(0,0,e.canvas.width,e.canvas.height).data);return t.every((e,t)=>e===r[t])}function p(e,t){e.clearRect(0,0,e.canvas.width,e.canvas.height),e.fillText(t,0,0);var n=e.getImageData(16,16,1,1);for(let e=0;e<n.data.length;e++)if(0!==n.data[e])return!1;return!0}function u(e,t,n,r){switch(t){case"flag":return n(e,"\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!n(e,"\ud83c\udde8\ud83c\uddf6","\ud83c\udde8\u200b\ud83c\uddf6")&&!n(e,"\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!r(e,"\ud83e\u1fac8")}return!1}function f(e,t,n,r){let a;const s=(a="undefined"!=typeof WorkerGlobalScope&&self instanceof WorkerGlobalScope?new OffscreenCanvas(300,150):document.createElement("canvas")).getContext("2d",{willReadFrequently:!0}),o=(s.textBaseline="top",s.font="600 32px Arial",{});return e.forEach(e=>{o[e]=t(s,e,n,r)}),o}function a(e){var t=document.createElement("script");t.src=e,t.defer=!0,document.head.appendChild(t)}r.supports={everything:!0,everythingExceptFlag:!0},new Promise(t=>{let n=function(){try{var e=JSON.parse(sessionStorage.getItem(s));if("object"==typeof e&&"number"==typeof e.timestamp&&(new Date).valueOf()<e.timestamp+604800&&"object"==typeof e.supportTests)return e.supportTests}catch(e){}return null}();if(!n){if("undefined"!=typeof Worker&&"undefined"!=typeof OffscreenCanvas&&"undefined"!=typeof URL&&URL.createObjectURL&&"undefined"!=typeof Blob)try{var e="postMessage("+f.toString()+"("+[JSON.stringify(o),u.toString(),c.toString(),p.toString()].join(",")+"));",r=new Blob([e],{type:"text/javascript"});const a=new Worker(URL.createObjectURL(r),{name:"wpTestEmojiSupports"});return void(a.onmessage=e=>{i(n=e.data),a.terminate(),t(n)})}catch(e){}i(n=f(o,u,c,p))}t(n)}).then(e=>{for(const n in e)r.supports[n]=e[n],r.supports.everything=r.supports.everything&&r.supports[n],"flag"!==n&&(r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&r.supports[n]);var t;r.supports.everythingExceptFlag=r.supports.everythingExceptFlag&&!r.supports.flag,r.supports.everything||((t=r.source||{}).concatemoji?a(t.concatemoji):t.wpemoji&&t.twemoji&&(a(t.twemoji),a(t.wpemoji)))});$