CVE-2020-13965
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
Published Jun 8, 2020 · updated Jun 16, 2026 · roundcube webmail
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Jun 8, 2020 · Catalog
Detected
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Jun 26, 2024 · CISA KEV
Known exploited
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jul 17, 2024 · CISA KEV
Remediation due
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Jun 16, 2026 · Catalog
Updated
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA due date Jul 17, 2024
Affected
- cpe debian/debian linux10.0
- cpe debian/debian linux9.0
- cpe fedoraproject/fedora31
- cpe fedoraproject/fedora32
- cpe roundcube/webmailversion unspecified
- vendor Roundcube Webmailversion unspecified
Sources
- CISA KEVConfirmed exploitationCVE-2020-13965
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.
cisa.gov - CVE.orgVulnerability recordCVE-2020-13965
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2020-13965
30-day exploitation probability 76.6%
first.org - NIST NVDVulnerability recordCVE-2020-13965
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
nvd.nist.gov