Roundcube · Roundcube Webmail
CVE-2020-35730
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
What it is
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CISA: Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: July 13, 2023
- Added to the CISA list
- June 22, 2023
- Published
- December 28, 2020
- Severity
- Medium 6.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 33% in the top 1.7% of all known vulnerabilities
- Weakness
- CWE-79
- More details
- NVD · CVE.org · CISA
All references (9)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCL…
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGID…
- https://roundcube.net/download/
- https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491
- https://www.alexbirnberg.com/roundcube-xss.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.10
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.13
More exploited flaws from Roundcube
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Webmail | Critical 9.8 | 84% |
| Jun 22, 2023 | Webmail SQL Injection | Roundcube Webmail | Critical 9.8 | 70% |
| Nov 3, 2021 | Webmail File Disclosure | Roundcube Webmail | High 7.8 | 46% |
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.3 | 77% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.