Loading vulnerability…
Roundcube Webmail CSS Proxy MIME-Sniffing Information Disclosure and XSS
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 fail to validate responses from the CSS proxy. Browser MIME sniffing of these unvalidated responses may cause content to be interpreted unsafely, resulting in sensitive information disclosure or cross-site scripting.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation may expose sensitive information or execute attacker-controlled script in the affected Roundcube browser context. The specific information accessible and the scope of script-driven actions are not established.
If you can’t patch tonight, do this now.
Apply the vendor or distribution security update. No separate workaround is specified.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), install Roundcube 1.6.18+dfsg-0+deb13u1 or later through the security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.