An e-mail HTML injection vulnerability was found in Passbolt before v2.7.0. Passbolt sends an e-mail to users to warn them about different types of events such as the creation, modification, or deletion of a password. Those e-mails may contain user-specified input, such as a password's title or description. Passbolt does not escape the user's input properly, resulting in the user being able to inject HTML code in an e-mail. An authenticated attacker could share a password containing an img HTML tag in its description with another user to obtain information about their mail user-agent. This vulnerability has a very low impact. Most MUA does not embed remote images to protect their users' privacy.