Posted by Evan Tang on Aug 26 https://blog.evan.lat/posts/CVE-2026-65053/

the blog talks about two vulns that are chainable together. for the sake of

brevity ill write up on the stored xss one.

in lib/Mime/Status.php, we see a pretty viable xss sink:

$out .= '<tr><td>' . $val . '</td></tr>';

xrefing this we see that most impls are sanitized with the exception of

lib/Mime/Viewer/Appledouble.php:

$data_name =...