A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NRoundcube Webmail
APPRoundcube< 1.5.81.6.0 – 1.6.8 (bez)
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
XSS
Related vulnerabilities
CVE-2025-49113CRITICAL9.9⚠ KEVPL ✓ten sam produkt
RCE przez deserializację PHP w Roundcube Webmail (parametr _from)
CVE-2024-42009CRITICAL9.3⚠ KEVPL ✓ten sam produkt
XSS w Roundcube Webmail umożliwiający kradzież i wysyłkę wiadomości e-mail
CVE-2021-44026CRITICAL9.8⚠ KEVten sam produkt
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_par...
CVE-2020-12641CRITICAL9.8⚠ KEVten sam produkt
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacha...
CVE-2024-37385CRITICAL9.8PL ✓ten sam produkt
Command injection w Roundcube Webmail na Windows (im_convert_path/im_identify_path)