EUVD-2026-60166
GHSA-pq94-h2h7-x49p
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Network-accessible stored XSS requiring low-privileged account and victim 'Add to address book' interaction; S:C because payload executes across security origin boundary.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
AnalysisAI
Stored XSS in Roundcube Webmail's 'Add to address book' feature allows a low-privileged authenticated attacker to inject persistent malicious scripts that execute in the browser sessions of other users who trigger the affected action. Affected versions span the 1.6.x branch before 1.6.18 and the 1.7.x branch before 1.7.3, both patched on 2026-08-09 per vendor advisory. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The attacker must hold a low-privileged authenticated account on the target Roundcube instance (confirmed by PR:L in the CVSS vector), sufficient to send or present a contact entry containing a malicious payload. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score is reasonable but understates practical webmail risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a low-privileged Roundcube account sends an email whose sender display name or contact field embeds a crafted XSS payload. When a victim user selects 'Add to address book' for that sender, the unsanitized payload is stored in the address book and executes in the victim's browser on subsequent loads, enabling the attacker to exfiltrate the victim's session cookie and hijack their mail session without any further interaction. … |
| Remediation | Upgrade to Roundcube Webmail 1.6.18 (stable branch) or 1.7.3 (next branch), both released 2026-08-09 and confirmed by the vendor advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary w
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today