Actively exploited in the wild
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube - Webmail · Listed in the CISA KEV since 2023-10-26. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-5631
MediumCVSS 6.1KEVSummary
Stored XSS vulnerability in Roundcube before 1.4.15, 1.5.5, and 1.6.4 allows a remote attacker to load arbitrary JavaScript code via an HTML email with a crafted SVG document.
Risk Assessment
Risk of session hijacking, data theft, or unauthorized actions in the context of the victim's account.
Recommendation
Update Roundcube to version 1.4.15, 1.5.5, 1.6.4 or later that includes the fix.
Other vulnerabilities in Roundcube
See all- CVE-2016-9920High
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
- CVE-2015-8770High
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
- CVE-2024-42009CriticalActively exploited
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- CVE-2023-43770MediumActively exploited
XSS vulnerability in Roundcube before 1.4.14, 1.5.4, and 1.6.3 allows XSS via text/plain email messages with crafted links.
- CVE-2021-44026CriticalActively exploited
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. The vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-48846Medium
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Original NVD description (English source)
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.