internet-facing-service-vulnerabilitywidely-deployed-product-advisorydetection-content-updateend-of-life-software

Roundcube fixes stored XSS, SSRF bypass, and TNEF flaws in Webmail

Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Jul 22, 2026

Roundcube released versions 1.6.17 and 1.7.2 to address multiple security flaws in its webmail platform, including stored cross-site scripting, SSRF bypasses, password plugin issues tied to session-injected usernames, and denial-of-service conditions in TNEF message handling. The advisory highlights CVE-2026-54432, a stored XSS issue caused by an unescaped attachment MIME type on the attachment-validation warning page, and CVE-2026-54433, described as a zero-click stored XSS triggered during plain-text rendering.

The fixes also resolve an infinite loop in the TNEF decoder, expanding the impact beyond browser-side compromise to service disruption risks. A related Nuclei template update added detection coverage for CVE-2026-54433, reflecting active defender interest in identifying exposed Roundcube instances. Roundcube also warned that the unsupported 1.5 LTS branch has reached end of support and may remain vulnerable to these issues as well as earlier flaws fixed in 1.6.16 and 1.7.1.

Do you run this?See affected versions and whether adversaries are exploiting it.

Check your exposure

Event timeline

How this story unfolded

Events from the most recent confirmed update back to the earliest known activity.

3 events · Jun 1, 2017 – Jul 22, 2026

Jul 22, 20264mo ago
Nuclei template PR adds detection for CVE-2026-54433
A GitHub pull request added and updated a Nuclei template entry for CVE-2026-54433, describing it as a critical zero-click stored XSS vulnerability in Roundcube Webmail. The visible discussion indicates follow-up edits to the associated YAML file on 2026-07-22.
Add CVE-2026-54433 for Roundcube Webmail XSS vulnerability by omarkurt · Pull Request #16639 · projectdiscovery/nuclei-templates · GitHub
Jun 1, 20179y ago
Roundcube warns unsupported 1.5 LTS branch is likely vulnerable
In the same security notice, Roundcube warned that the unsupported 1.5 LTS branch had reached end of support and was likely affected by at least some of the newly addressed issues as well as earlier flaws fixed in 1.6.16 and 1.7.1. No specific date for the end-of-support event is provided in the source content.
oss-sec: CVE-2026-54432+more: Roundcube XSS/SSRF/etc prior to 1.6.17/1.7.2
Jun 1, 20179y ago
Roundcube releases 1.6.17 and 1.7.2 security updates
On 2026-07-05, Roundcube released versions 1.6.17 and 1.7.2 to fix multiple vulnerabilities in its webmail software, including stored XSS, SSRF bypasses, password plugin issues, and TNEF-related denial-of-service and infinite loop flaws. The advisory explicitly mentions CVE-2026-54432 and CVE-2026-54433 among the fixed issues.
oss-sec: CVE-2026-54432+more: Roundcube XSS/SSRF/etc prior to 1.6.17/1.7.2

Linked entities

Related entities

Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.

Open in app →

Vulnerabilities

2 linked

Stored XSS in Roundcube Webmail plain-text rendering (CVE-2026-54433)Stored XSS in Roundcube Webmail Attachment-Validation Warning Page (CVE-2026-54432)

Affected products

1 linked

Roundcube Webmail

Organizations

1 linked

Roundcube

Do you run this?See whether adversaries are exploiting this yet, and where the affected versions run in your environment.

Check Your Exposure

Source coverage

Sources

2 references tracked. Mallory keeps watching after this page renders.

Nuclei Templates Pull RequestsNews · Jul 22, 2026

Add CVE-2026-54433 for Roundcube Webmail XSS vulnerability by omarkurt · Pull Request #16639 · projectdiscovery/nuclei-templates · GitHubOpen source ↗

Oss Security Mailing ListNews · Jun 1, 2017

oss-sec: CVE-2026-54432+more: Roundcube XSS/SSRF/etc prior to 1.6.17/1.7.2Open source ↗

Mallory platform

See the full picture, correlated to your attack surface.

This page covers what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which threat actors are using it right now, and what to deploy next.

Start Free Trial Open in App

Exposure mappingMap indicators from this story to your assets and identify affected systems in minutes.

Threat actor evidenceEvery observed campaign, victim, and pivot linked to actors named in this story.

Associated malwareMalware, exploits, and IOCs connected to the activity described here.

Detection signaturesYARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.

Scheduled alertsGet matching new stories delivered to your team as they break, not the next morning.

AI threadsAsk questions about this story and take action on the answers.

Roundcube fixes stored XSS, SSRF bypass, and TNEF flaws in Webmail

How this story unfolded

Nuclei template PR adds detection for CVE-2026-54433

Roundcube warns unsupported 1.5 LTS branch is likely vulnerable

Roundcube releases 1.6.17 and 1.7.2 security updates

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Roundcube Fixes Zero-Click XSS, SSRF, and 10 Other Webmail Flaws

Roundcube fixes arbitrary file write and multiple webmail security flaws

Roundcube Webmail Patches Pre-Auth SQLi, Code Injection, and RCE-Class Flaws

Roundcube fixes stored XSS, SSRF bypass, and TNEF flaws in Webmail

How this story unfolded

Nuclei template PR adds detection for CVE-2026-54433

Roundcube warns unsupported 1.5 LTS branch is likely vulnerable

Roundcube releases 1.6.17 and 1.7.2 security updates

Related entities

Vulnerabilities

Affected products

Organizations

Sources

See the full picture, correlated to your attack surface.

Related stories

Roundcube Fixes Zero-Click XSS, SSRF, and 10 Other Webmail Flaws

Roundcube fixes arbitrary file write and multiple webmail security flaws

Roundcube Webmail Patches Pre-Auth SQLi, Code Injection, and RCE-Class Flaws