PatchSiren cyber security CVE debrief

CVE-2026-10234 Mettle CVE debrief

A stored or reflected cross-site scripting (XSS) vulnerability exists in Mettle SendPortal up to version 3.0.1, specifically within the Campaign Handler component's /webview/ endpoint. The vulnerability is triggered by manipulation of the 'content' parameter. The attack vector is remote, requires low privileges, and user interaction. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no required privileges (PR:L in vector but description implies some auth), user interaction required, with impact to integrity only (low). The vulnerability has been publicly disclosed with exploit availability noted as 'present' (E:P in CVSS vector). The vendor was notified via GitHub issue #338 but had not responded at time of CVE publication. The weakness classifications include CWE-79 (XSS) and CWE-94 (Code Injection).

Vendor: Mettle
Product: sendportal
CVSS: LOW 2
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-06-01
Original CVE updated: 2026-06-01
Advisory published: 2026-06-01
Advisory updated: 2026-06-01

Who should care

Organizations running self-hosted instances of Mettle SendPortal ≤3.0.1, particularly those with untrusted or compromised user accounts that can create or modify campaign content. Security teams monitoring for unpatched public vulnerabilities with available exploits.

Technical summary

The vulnerability exists in the /webview/ path of the Campaign Handler component in Mettle SendPortal ≤3.0.1. The 'content' parameter accepts user input that is rendered without adequate sanitization, permitting injection of executable scripts. The CVSS 4.0 score of 2.0 (LOW) reflects limited impact scope (integrity only, no confidentiality or availability impact) and required user interaction, though the public exploit availability increases practical risk. The PR:L (low privileges required) in the CVSS vector suggests authenticated access may be needed, consistent with campaign management functionality.

Defensive priority

medium

Recommended defensive actions

Review and sanitize all user-supplied input to the /webview/ endpoint, particularly the 'content' parameter, using context-appropriate encoding (HTML entity encoding for HTML contexts, JavaScript encoding for script conx
Implement Content Security Policy (CSP) headers to mitigate impact of any XSS vulnerabilities in the Campaign Handler
Monitor for and apply updates from the Mettle SendPortal project; consider temporary input validation or WAF rules for the /webview/ path if patching is delayed
Review GitHub issue #338 for additional technical details and community discussion
Conduct code review of the Campaign Handler component for additional instances of unsanitized output

Evidence notes

CVE published 2026-06-01 with Vuldb as CNA. GitHub issue #338 filed but vendor non-responsive. CVSS 4.0 vector: AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P. Weaknesses: CWE-79, CWE-94.

Official resources

public