Postal HTML Injection Vulnerability in Admin Interface

A HTML injection vulnerability has been identified in Postal versions prior to 3.3.5. This issue allows unescaped data to be injected into the admin interface, primarily through the API's 'send/raw' method. The vulnerability could be exploited to inject arbitrary HTML, potentially misleading users or enabling unauthorized execution of JavaScript.

Impact

Exploitation of this vulnerability could lead to HTML injection in the admin interface, allowing for the execution of unauthorized JavaScript.

Remediation

Users can upgrade to Postal version 3.3.5 or higher to address this vulnerability. If the legacy API is not used to deliver messages, exposure to this vulnerability is limited, as the SMTP server sanitizes '<' and '>' characters.