A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NRoundcube Webmail
APPRoundcube< 1.5.81.6.0 – 1.6.8 (bez)
CISA KEV — detailsi
- Vendori
- Roundcube
- Producti
- Webmail
- Added to KEVi
- June 9, 2025
- Remediation deadline (US Federal)i
- June 30, 2025(overdue)
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Related vulnerabilities
RCE przez deserializację PHP w Roundcube Webmail (parametr _from)
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_par...
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacha...
XSS w Roundcube Webmail umożliwiający kradzież i wysyłkę e-maili ofiary
Command injection w Roundcube Webmail na Windows (im_convert_path/im_identify_path)