GHSA-v86m-j5f7-ccwh: 
PHP vulnerability analysis and mitigation

A moderate severity HTML injection vulnerability was identified in Passbolt API affecting versions prior to 2.7.0. The vulnerability was discovered and disclosed on February 12, 2019. Passbolt, a password management system, sends emails to users about various password-related events such as creation, modification, or deletion (GitHub Advisory).

The vulnerability stems from improper escaping of user-specified input in email notifications. When sending emails about password events, the system failed to properly sanitize user inputs such as password titles and descriptions. The vulnerability has been assigned a CVSS v3.1 score of 4.4 (Moderate) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

The vulnerability allows an authenticated attacker to inject HTML code into emails, particularly through password descriptions. This could be exploited to gather information about recipients' mail user agents through techniques such as embedding img HTML tags. However, the impact is considered very low since most Mail User Agents (MUAs) do not automatically embed remote images to protect user privacy (GitHub Advisory).

The vulnerability was patched in Passbolt API version 2.7.0. The fix involved implementing proper HTML purification for user inputs in email content (GitHub Commit).