Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
2.3

Gophish may let attackers run scripts via email error messages

CVE-2026-107272 · published 11 days ago
Summary

The Gophish phishing‑simulation platform can be tricked into running malicious code when a wrong or intercepted email server sends back an error. If an attacker can control or watch the email server used for a campaign, they could steal sensitive data like API keys when an administrator views results or sends test emails. Update Gophish to the latest version or apply the vendor’s patch to stop this behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gophish gophish <= 0.12.1
Original advisory text
Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages
Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view campaign results or send test emails, stealing API keys.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
2.3 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published7 Oct 2026
Updated14 Oct 2026
First seen7 Oct 2026
Sources
CVE-2026-107272 · NVD
CVE-2026-107272 · MITRE
CVE-2026-107272 · OSV
Track software like this
Free during beta