Loading vulnerability…
Stored XSS in Roundcube Webmail Attachment-Validation Warning Page
Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 contains a stored cross-site scripting vulnerability in its attachment-validation warning page. The page fails to properly escape an attachment's MIME type before rendering it, allowing an attacker-controlled MIME type string to execute arbitrary JavaScript in the victim's Roundcube session. Execution occurs when the affected warning page loads, without a further click or attachment download.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation executes attacker-controlled JavaScript within the Roundcube web origin and the victim's session. This can enable unauthorized mailbox access, sensitive-data theft, and actions performed with the victim's privileges. Session compromise and credential theft are potential consequences.
If you can’t patch tonight, do this now.
No separate workaround or temporary mitigation is documented. Deploy the security update.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.17 or later in the 1.6 branch, or version 1.7.2 or later in the 1.7 branch. For Debian stable (trixie), install roundcube version 1.6.17+dfsg-0+deb13u1 or a subsequent security-fixed package.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.