Loading vulnerability…
Stored XSS in Roundcube Webmail Add to address book
CVE-2026-74999 is a stored cross-site scripting vulnerability in the "Add to address book" action in Roundcube Webmail before 1.6.18 and in the 1.7.x series before 1.7.3. Attacker-controlled content processed through this feature can result in persistent script execution in a victim's browser within the Roundcube application context. The vulnerability is rated medium severity with a CVSS score of 5.4.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can execute attacker-controlled JavaScript in a victim's Roundcube browser context, potentially exposing sensitive webmail data, enabling unauthorized actions using the victim's session, or compromising the session. Server-side code execution and the other impacts associated with the broader Roundcube security update are not established for this vulnerability.
If you can’t patch tonight, do this now.
No separate workaround is specified. Apply the vendor security update promptly; where immediate patching is not possible, restrict untrusted users' ability to submit or modify address-book entries and limit access to affected webmail instances.
Patch, then assume compromise.
Upgrade Roundcube Webmail to 1.6.18 or later in the 1.6 series, or 1.7.3 or later in the 1.7 series. For Debian stable (trixie), upgrade the Roundcube packages to 1.6.18+dfsg-0+deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.