Listen to this Post
CVE-2026-54893 is a URL path injection vulnerability discovered within the Microsoft Graph adapter of the Swoosh library for Elixir.
The vulnerability specifically resides in the `lib/swoosh/adapters/ms_graph.ex` file, within the `api_endpoint_url/2` function.
When an application utilizes `Swoosh.Adapters.MsGraph` to dispatch emails via the Microsoft Graph API, it constructs the target endpoint URL dynamically.
The construction process involves taking the sender’s email address from the email struct and interpolating it directly into the URL path template.
The path template used is /users/{from}/sendMail, placing the sender identifier right into the middle of the URI structure.
Crucially, the library takes this `from` value verbatim without applying any percent-encoding operations.
Furthermore, the library fails to validate the input against the character set defined in RFC 5321 before placing it into the URL string.
Because the sender address occupies the local part of the `/users/{from}/sendMail` endpoint path, special characters are left completely unneutralized.
An attacker who has control over or can influence the sender email address can supply malicious payloads containing reserved URL characters.
Specifically, characters such as the forward slash (/), question mark (?), and hash () can be injected into the local part.) truncates the remainder of the intended path, allowing the request to terminate prematurely at a controlled location.
A forward slash (`/`) allows an attacker to append arbitrary new path segments or replace existing ones to traverse the route structure.
A question mark (`?`) introduces an attacker-controlled query string, altering the parameters received by the backend endpoint.
A hash (
When `deliver/2` executes, it issues an authenticated POST request to this newly constructed and manipulated URL.
Importantly, this request is dispatched using the application’s valid and active Microsoft Graph bearer token with its existing privileges.
Because the bearer token remains attached to the request, the forged URL steers the authenticated call to entirely different Graph endpoints.
This results in a constrained server-side request forgery vulnerability targeting the Microsoft Graph API ecosystem.
Applications that rely on static, hardcoded, and trusted sender addresses never reach this injectable path and remain completely safe.
However, applications integrating user-facing contact forms, relay services, or “send as” features are directly exposed to this flaw.
Exploitation requires no prior authentication beyond the ability to input a crafted sender address with malicious URL delimiters.
Once triggered, the system blindly executes the request against the manipulated path under the application’s security context.
Mitigation requires implementing strict percent-encoding and character validation on all dynamic fields interpolated into API routes.
Developers must ensure that user-influenced inputs cannot alter the underlying structure of the requested Uniform Resource Identifier.
Upgrading the Swoosh dependency to the patched version resolves the unvalidated path interpolation vulnerability entirely.
DailyCVE Form:
Platform: Swoosh MsGraph Adapter
Version: 1.12.0 to 1.26.2
Vulnerability: URL Path Injection
Severity: Low
date: July 6, 2026
Prediction: July 6, 2026
What Undercode Say:
mix deps.get mix deps.update swoosh
defp api_endpoint_url(from, config) do
base_url(config) <> "/users/{from}/sendMail"
end
Exploit: (Educational Purposes!)
malformed_from = "attacker/../some_endpoint?param=value"
Protection:
{:swoosh, "~> 1.26.3"}
Impact:
An attacker capable of influencing the sender email address can redirect authenticated Microsoft Graph requests to arbitrary endpoints within the bearer token’s permission scopes, turning the mail-sending feature into a constrained server-side request forgery vector against the Microsoft Graph API.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
