mail-archiver

v2606.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 1mo Communication & Email

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 2 known CVEs

Topics

archive archiver backup docker imap mail

+1 more

migration

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates ⚙️ Improvements, ✨ New Features, and https://github.com/s1t5/mail-archiver/blob/main/doc/M365TenantImport.md across a mixed release.

Full changelog

✨ New Features

M365 Tenant Import: You can now create accounts for all mailboxes in an M365 tenant in a single batch operation. See documentation here. Thanks to tilwegner for this new feature!
Customizable OIDC Login Buttons: OIDC login buttons can now be configured with provider-specific labels. See documentation here. Thanks to tilwegner for this new feature!

⚙️ Improvements

Fixed User Edit Mass Assignment: The user edit form now binds a dedicated view model, preventing attackers from overwriting protected fields such as IsAdmin, TwoFactorSecret, or OAuthRemoteUserId.
Updated GetM365Credentials Endpoint The GetM365Credentials now only returns the client ID and tenant ID.
Fixed XSS in Email Reply Button: Email metadata used by the reply button is now passed to JavaScript as properly escaped JSON instead of unencoded data-* attributes.
Hardened HTML Email Iframe Sandbox: Removed allow-same-origin from the email content iframe sandbox so that JavaScript in HTML emails cannot access the parent page.
Added Import File Extension Whitelist: MBox and EML uploads now validate file extensions; only .mbox, .eml, and .zip files are accepted.

Security Fixes

Fixed XSS in Email Reply Button by escaping metadata as JSON
Hardened HTML Email Iframe Sandbox by removing allow-same-origin from the sandbox attribute

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track mail-archiver

Get notified when new releases ship.

About mail-archiver

Mail-Archiver is a web application for archiving, searching, and exporting emails from multiple accounts. Featuring folder sync, attachment support, mailbox migration and a dashboard.

All releases →

Related context

Related tools

Earlier breaking changes

v2606.1 Migrates all existing attachments, temporarily increasing storage requirements; backup required before upgrade