CVE-2026-54433
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
In Roundcube Webmail before versions 1.6.17 and 1.7.x before 1.7.2, a stored Cross-Site Scripting (XSS) vulnerability exists via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).
Risk Assessment
The risk involves potential session hijacking, data theft, or unauthorized actions within the victim's email account, requiring no user interaction.
Recommendation
Immediately upgrade Roundcube Webmail to version 1.6.17 or 1.7.2, which contain the fix for this vulnerability.
Other vulnerabilities in Roundcube Webmail
See all- CVE-2026-75010Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.
- CVE-2026-75006Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure, e.g., if stylesheet links point to local network hosts. This is due to incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.
- CVE-2026-75004Medium
Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.
- CVE-2026-74999Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.
- CVE-2026-74998High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.
- CVE-2026-74997High
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
- CVE-2015-5383High
Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.
- CVE-2017-8114High
Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.
- CVE-2016-4069High
CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.
- CVE-2026-75007Medium
Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.
Original NVD description (English source)
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).