A vulnerability classified as problematic was found in bulwarkmail webmail up to 1.4.10. The impacted element is an unknown function of the component Email Handler. Such manipulation of the argument Content-Security-Policy-Report-Only leads to cross site scripting.
This vulnerability is referenced as CVE-2026-35390. It is possible to launch the attack remotely. No exploit is available.
Upgrading the affected component is advised.
