pwn.watch: Roundcube incident updates

[high] Roundcube Webmail: RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Fri, 20 Feb 2026 00:00:00 GMT

RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. CISA added CVE-2025-49113, CVE-2025-68461 to the Known Exploited Vulnerabilities catalog on 2026-02-20 based on evidence of active exploitation.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-02-20: CISA added CVE-2025-49113, CVE-2025-68461 to the KEV catalog (due 2026-03-13).

CVEs: CVE-2025-49113, CVE-2025-68461

[critical] Roundcube Webmail: Webmail Cross-Site Scripting Vulnerability

Mon, 09 Jun 2025 00:00:00 GMT

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. Added to CISA KEV on 2025-06-09.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2025-06-09: CISA added CVE-2024-42009 to the KEV catalog (due 2025-06-30).

CVEs: CVE-2024-42009

[medium] RoundCube Webmail Cross-Site Scripting (XSS)

Thu, 24 Oct 2024 00:00:00 GMT

RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code. Added to the CISA KEV catalog on 2024-10-24.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-10-24: CISA added CVE-2024-37383 to the KEV catalog (federal deadline 2024-11-14) (source)
2024-06-07: CVE-2024-37383 published (source)

CVEs: CVE-2024-37383

[medium] Roundcube Webmail Cross-Site Scripting (XSS)

Wed, 26 Jun 2024 00:00:00 GMT

Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment. Added to the CISA KEV catalog on 2024-06-26. CVE-2020-13965 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-06-26: CISA added CVE-2020-13965 to the KEV catalog (federal deadline 2024-07-17) (source)

CVEs: CVE-2020-13965

[medium] Roundcube Webmail Persistent Cross-Site Scripting (XSS)

Mon, 12 Feb 2024 00:00:00 GMT

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages. Added to the CISA KEV catalog on 2024-02-12. CVE-2023-43770 was assigned before 2024; the KEV listing came in 2024.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-02-12: CISA added CVE-2023-43770 to the KEV catalog (federal deadline 2024-03-04) (source)

CVEs: CVE-2023-43770

[medium] Roundcube Webmail: Persistent Cross-Site Scripting (XSS) (CVE-2023-5631)

Thu, 26 Oct 2023 00:00:00 GMT

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code. Added to CISA KEV on 2023-10-26.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2023-10-26: CISA added CVE-2023-5631 to the KEV catalog (due 2023-11-16).

CVEs: CVE-2023-5631