Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

MEDIUM 6.1EXPLOITED (CISA KEV)CVE-2020-13965 · Published 09/06/2020 · updated 17/06/2026

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/06/2024. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
webmail roundcube	`≥ 1.4.0, < 1.4.5< 1.3.12`	`1.4.51.3.12`

Description

An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.

References

DrunkenShells/Disclosures · Exploit
roundcube/roundcubemail commit 884eb61 · Patch
roundcube/roundcubemail · Patch
roundcube/roundcubemail release 1.3.12 · Release Notes
roundcube/roundcubemail release 1.4.5 · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK · Mailing List
roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 · Vendor Advisory
debian.org/security/2020/dsa-4700 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-13965

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free