A cross-site scripting vulnerability in Postal SMTP server versions before 3.3.5 allows authenticated attackers to execute unauthorized JavaScript within the admin interface.

This vulnerability is a cross-site scripting (CWE-79) flaw affecting the administrative interface. It is triggered by injecting unescaped data through the API's "send/raw" method, requiring an attacker to have low-level authenticated access to successfully exploit the system.

Successful exploitation permits an authenticated attacker to execute malicious scripts within the context of an administrator's browser session. Given the CVSS score of 8.1, this represents a high-severity risk that could lead to unauthorized administrative actions, session hijacking, or data manipulation, significantly compromising the integrity and security of the mail server management environment.

Immediate Action: Upgrade the Postal SMTP server installation to version 3.3.5 or higher immediately to apply the necessary input sanitization fixes.

Proactive Monitoring: Audit administrative access logs for unusual activity or unexpected API calls originating from non-standard user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads, particularly those targeting administrative endpoints.

Public Exploit Available: No confirmed public exploit is available.

This vulnerability poses a significant risk to the administrative integrity of the Postal SMTP platform. Organizations currently running versions below 3.3.5 must prioritize upgrading to the patched release to neutralize the risk of stored cross-site scripting attacks. Failure to update may allow an attacker with standard user privileges to escalate their control over the administrative interface.