Actively exploited in the wild
RoundCube Webmail Cross-Site Scripting Vulnerability
Roundcube - Webmail · Listed in the CISA KEV since 2025-06-09. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2024-42009
CriticalCVSS 9.3KEVSummary
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Risk Assessment
An attacker could take over the victim's email account, steal and send emails on their behalf, leading to confidentiality and reputation breaches.
Recommendation
Update Roundcube to version 1.5.8 or 1.6.8 (or later) which fix this vulnerability.
Other vulnerabilities in Roundcube
See all- CVE-2016-9920High
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
- CVE-2015-8770High
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
- CVE-2021-44026CriticalActively exploited
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. The vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-48846Medium
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Original NVD description (English source)
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.