CVE-2023-48114: SmarterTools SmarterMail

Medium severity, CVSS 5.4. EPSS: 0.4% chance of exploitation in the next 30 days.

SmarterTools SmarterMail 8495 through 8664 before 8747 allows stored XSS by using image/svg+xml and an uploaded SVG document. This occurs because the application tries to allow youtube.com URLs, but actually allows youtube.com followed by an @ character and an attacker-controlled domain name.

Affected products

• SmarterTools SmarterMail: from 16.0.8495, before 16.0.8747 (fixed in 16.0.8747)

Published 2023-12-21. Last modified 2026-06-17.