Roundcube Webmail EUVD-2026-107882

Exploitation requires the Roundcube 'password' plugin to be enabled and configured with a driver whose error text an attacker can influence - the description specifically names a backend such as the DirectAdmin API returning attacker-controlled error text. The vulnerable code path is the password driver error-response handler in password.php/directadmin.php, where driver message text was concatenated into the user-facing message without HTML escaping. A victim must actively initiate a password-change operation (UI:R) for the malicious error to be rendered, and the affected versions are Roundcube before 1.6.20 and 1.7.x before 1.7.5. Limiting factors: the attacker does not control Roundcube directly but must sit on or compromise the password backend, the password plugin must be deployed (it is optional), and user interaction is mandatory - making opportunistic mass exploitation impractical.

This is a genuinely low-to-moderate priority issue despite its CWE-79 (XSS) classification, and the signals are internally consistent rather than conflicting. The provided CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7, Medium) correctly reflects several dampening factors: AC:H because the attacker cannot simply send a payload to Roundcube but must control or influence the error text returned by a password-change backend driver (the description cites the DirectAdmin API); UI:R because a victim must actively initiate a password change through the password plugin; and only Low confidentiality/integrity impact with no availability impact (C:L/I:L/A:N). The scope change (S:C) is the one signal that raises severity, reflecting that injected script executes in the victim's authenticated Roundcube session context. No EPSS score was supplied in the input, so exploitation probability cannot be quantified from the data. The CVE is NOT in CISA KEV and no proof-of-concept is referenced, so this is no public exploit identified at time of analysis. The PR:N marking means Roundcube itself requires no authentication from the attacker's perspective, but the real precondition - control over the backend driver's error response - is a meaningful barrier not captured by PR. Overall: a real but hard-to-exploit, high-complexity, user-interaction-dependent XSS, not an urgent mass-exploitation threat.

A hosting provider's password-change backend (e.g., a DirectAdmin server the attacker controls or can influence) returns an error message containing an embedded HTML/script payload. When a Roundcube user attempts to change their password via the password plugin, the unescaped driver error text is concatenated into the on-screen message and the script executes in the victim's authenticated webmail session. No public exploit code is referenced in the available data.