Medium severity · published Sep 29, 2026
CVE-2026-102372
GestSup before 3.2.61 Stored XSS via Email Body in LOGIN IMAP Connector
6.1
CVSS
0.2%
EPSS
No
On KEV
Description
GestSup versions before 3.2.61 fail to properly sanitize HTML email bodies in the IMAP LOGIN connector, allowing unauthenticated attackers to store arbitrary JavaScript in ticket descriptions and replies. Attackers can send emails to the monitored mailbox containing script tags and event handlers that execute in technician browsers, enabling ticket data theft and unauthorized actions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GE
GestSup · GestSup
before 3.2.61 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-102372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-102372
release-notes
https://gestsup.fr/index.php?page=changelog
product
https://gestsup.fr/index.php?page=download
patch
https://gestsup.fr/index.php?page=download&channel=stable&version=3.2.61&type=patch
third-party-advisory
https://www.vulncheck.com/advisories/gestsup-before-3.2.62-stored-xss-via-email-body-in-login-imap-connector
technical-description
https://blog.spiizn.xyz/articles/remote-code-execution-turning-a-ticket-into-a-new-issue/
More from GestSup
9.8
CVE-2021-31646
Gestsup before 3.2.10 allows account takeover through the password recovery functionality (remote)
8.8
CVE-2026-22194
GestSup <= 3.2.60 CSRF Allows Privileged Actions
8.1
CVE-2026-100389
GestSup before 3.2.62 Remote Code Execution via IMAP Attachment
8.1
CVE-2026-22196
GestSup < 3.2.60 SQL Injection in Ticket Creation
8.1
CVE-2026-22197
GestSup < 3.2.60 Multiple SQL Injections in Asset List