Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-104083

CVE-2026-104083MEDIUM

Smartertools Smartermail — SmarterMail < Build 9777 Stored Mutation XSS via MathML Foreign Content

  AV  AC  AT  PR  UI  VC  VI  VA   CVSS    EPSS   %ile   KEV
   N   L   N   N   P   N   N   N    5.3   .0029   19.8     —

AFFECTED
  Product      Versions     Fixed
  Smartermail  unspecified  —

TIMELINE
  Oct 1   Reserved by VulnCheck
  Oct 9   Published (CNA: VulnCheck)
  Oct 12  EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added.
  Oct 13  EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added.

CWE-79 · CNA: VulnCheck · CVSS v4.0 · 3 references · NVD status: Awaiting Analysis

Description

SmarterMail before build 9777 contains a stored mutation cross-site scripting vulnerability that allows remote attackers to inject executable script by placing payloads inside a <style> element nested within MathML foreign content (<math><mtext><mglyph>), which the custom HTML sanitizer treats as inert CDATA text but browsers reparse as live markup. Attackers can deliver a crafted calendar (iCal) message containing an <img src=x onerror=...> payload that executes automatically in the recipient's webmail session at /interface/message-iframe when the message is opened, enabling script execution and data exfiltration unconstrained by the interface's permissive Content-Security-Policy.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
October 1, 2026	Reserved	Reserved by VulnCheck
October 9, 2026	Published	Published (CNA: VulnCheck)
October 12, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added.
October 13, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-104083 (Smartertools Smartermail). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Smartertools	Smartermail	—	—	—

Weaknesses

CWE-79

References (3)

Authoritative record: CVE-2026-104083 at cve.org

Vendors: smartertools

Weaknesses: CWE-79

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-104083 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.