Critical Cross-Site Scripting Vulnerability Discovered in RoundCube Webmail

What changed

A significant Cross-Site Scripting (XSS) vulnerability has been discovered in RoundCube Webmail versions up to 1.6.7. This flaw enables remote attackers to execute malicious scripts, which can lead to unauthorized access to victims' email accounts.

The vulnerability arises from a desanitization issue in the message_body() function within the program's mail handling code, specifically in show.php.

Who is affected

Users of RoundCube Webmail versions 1.5.7 and 1.6.x up to 1.6.7 are at risk of exploitation due to this vulnerability.

Organizations relying on this webmail solution for email communication may face severe security threats.

• RoundCube Webmail versions 1.5.7 and 1.6.x up to 1.6.7
• Organizations using RoundCube for email management
• Individuals who utilize RoundCube for personal or professional email

What to do

It is crucial for users and organizations to update their RoundCube installations to the latest version to mitigate the risk associated with this vulnerability.

Regular security audits and monitoring for suspicious activities should also be implemented to protect email accounts.

• Upgrade to the latest version of RoundCube Webmail immediately.
• Conduct security assessments to identify potential vulnerabilities.
• Educate users about the risks of phishing and malicious emails.