Roundcube · Webmail
CVE-2023-5631
Stored XSS vulnerability in Roundcube
What it is
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
CISA: Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: November 16, 2023
- Added to the CISA list
- October 26, 2023
- Published
- October 18, 2023
- Severity
- Medium 6.1 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 76% in the top 0.5% of all known vulnerabilities
- Weakness
- CWE-79
- More details
- NVD · CVE.org · CISA
All references (15)
- https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.4
- https://github.com/roundcube/roundcubemail/releases/tag/1.5.5
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.15
- https://github.com/roundcube/roundcubemail/issues/9168
- https://roundcube.net/news/2023/10/16/security-update-1.6.4-released
- https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d
- https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079
- https://www.debian.org/security/2023/dsa-5531
- https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html
- http://www.openwall.com/lists/oss-security/2023/11/01/1
- http://www.openwall.com/lists/oss-security/2023/11/01/3
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCR…
- http://www.openwall.com/lists/oss-security/2023/11/17/2
More exploited flaws from Roundcube
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.3 | 77% |
| Feb 12, 2024 | Persistent Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 64% |
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Webmail | Critical 9.8 | 84% |
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 33% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.