Executive brief
Roundcube Webmail, a widely used open-source email platform, contains a critical security flaw that allows attackers to compromise user accounts. By sending a specially crafted email, an attacker can gain the ability to read a victim's private messages or send unauthorized emails from their account. This vulnerability has been observed being used in active attacks, posing a significant risk to organizational communication and data privacy.
Technical details
A stored Cross-Site Scripting (XSS) vulnerability exists in Roundcube Webmail due to a desanitization issue within the message_body() function in program/actions/mail/show.php. An unauthenticated remote attacker can exploit this by sending a malicious email that, when viewed by a victim, executes arbitrary JavaScript in the context of the victim's browser session. This can lead to full session hijacking, allowing the attacker to read, delete, or send emails as the victim. The vulnerability affects versions through 1.5.7 and 1.6.x through 1.6.7, and has been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Patches are available in versions 1.5.8 and 1.6.8.
Affected products
- Roundcube Webmail Through 1.5.7, and 1.6.x through 1.6.7
Timeline
- 2024-08-04: patched: Vendor released versions 1.5.8 and 1.6.8 to address the issue.
- 2024-08-05: disclosed: Initial CVE publication.
- 2025-06-09: kev added: CISA added the vulnerability to the Known Exploited Vulnerabilities catalog.