Executive brief
Roundcube Webmail, a widely used open-source web-based email client, is vulnerable to a security flaw that could allow an attacker to execute malicious scripts in a user's browser. This occurs when a user previews a specially crafted HTML email attachment. If exploited, an attacker could potentially steal session cookies, access sensitive email data, or perform actions on behalf of the user within the webmail interface.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Roundcube Webmail's attachment preview functionality. The root cause is insufficient sanitization of HTML content within the `display_uploaded_file` method in `rcmail_action.php` and `rcube_uploads.php`. An attacker can send an email with a malicious `text/html` attachment; when the recipient uses the 'preview' feature, the unsanitized script executes in the context of the user's session. This can lead to session hijacking or unauthorized data access. The issue is resolved in versions 1.5.14, 1.6.14, and 1.7-rc5.
Affected products
- Roundcube Webmail < 1.5.14, 1.6.x < 1.6.14, 1.7-rc < 1.7-rc5
Timeline
- 2026-03-18: patched: Security updates released for 1.5, 1.6, and 1.7 branches.
- 2026-04-03: disclosed: CVE published to NVD.
References
- https://github.com/roundcube/roundcubemail/commit/10a6d1fa8acac85c727b0a6ae4a6642bfa27bea1
- https://github.com/roundcube/roundcubemail/commit/1b30edf5369668c92fe91dae3d52e477c808aa4f
- https://github.com/roundcube/roundcubemail/commit/d742954ccbcdee7020f8f2e7c49ce0fca5a0efab
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.14
- https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5
- https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14