CVE-2026-25529
High
Description
Postal is an open source SMTP server. Postal versions less than 3.3.5 had a HTML injection vulnerability that allowed unescaped data to be included in the admin interface. The primary way for unescaped data to be added is via the API's "send/raw" method. This could allow arbitrary HTML to be injected in to the page which may modify the page in a misleading way or allow for unauthorised javascript to be executed. Fixed in 3.3.5 and higher.
SeverityHigh
CVSS8.1
Exploit probability—
ProductPostal
PublishedMar 12, 2026
First seenMar 12, 2026
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- postalserver postal3.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| postalserver postal | v < 3.3.5 | 3.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.