Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability (CVE-2023-5631)

Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.

Published Oct 18, 2023 · Updated May 29, 2026

X LinkedIn

Why patchRisk explained in plain English

Worst-case scenarioIf unpatched

A remote attacker, without authentication, can achieve partial data exposure, partial data tampering. Federal agencies are required to remediate by 2023-11-16 under CISA BOD 22-01.

How the attack worksNo clicks needed

This is a Cross-Site Scripting (XSS) (CWE-79) vulnerability in Roundcube Webmail. Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. Exploitation requires remote network access, low attack complexity, no authentication required, and user interaction required.

📧

Phishing link

→

🖼

Malicious file

🔓

Server compromised

Am I affected?Quick check

Probably yes if any of these apply:

●IT Security

●Running webmail: v < 1.4.15, 1.5.0 ≤ v < 1.5.5, 1.6.0 ≤ v < 1.6.4; debian linux: 10.0, 11.0, 12.0; fedora: 39

Real-world incidentsWhat we've seen

Active exploitation documented in the wild. Threat-research write-up: https://github.com/roundcube/roundcubemail/issues/9168

How to patch

Get the fix

Apply the fixed package from your vendor. The advisory lists affected versions and the exact fixed build.

↗ Vendor advisory

Manual remediation steps

Apply the Vendor Patch

This vulnerability is in the CISA Known Exploited Vulnerabilities catalog — apply the vendor's security update as soon as possible.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

Vendor advisory: https://roundcube.net/news/2023/10/16/security-update-1.6.4-released, https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15

NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2023-5631

CISA KEV: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631

PowerShell automationComing soon

No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.

References

↗ CVE-2023-5631 ↗ Advisory