## swoosh has email-derived URL path injection in Microsoft Graph endpoint

- 種別: advisory
- 重大度: low
- 関連技術: erlang
- CVE: CVE-2026-54893
- 公開日時: 2026-10-16T19:22:31.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-754j-98wh-57rf)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-754j-98wh-57rf

影響: erlang:swoosh >= 1.12.0, < 1.26.3 → 1.26.3
Summary Swoosh.Adapters.MsGraph builds its Microsoft Graph API request URL by interpolating the sender's email address directly into the URL path (/users/{from}/sendMail) without percent-encoding or validation. In applications that derive the from address from untrusted or user-influenced input (a relay, a contact form, or a "send as" feature), an attacker can inject URL-special characters into the local part of the address to escape the intended path segment and rewrite the request's path and…