CISA KEV catalog
Confirmed active exploitation.
Listed in CISA's catalog of Known Exploited Vulnerabilities: attackers are using it in real attacks. Patch it with priority.
- Name
- Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Affected products
roundcube: webmail; debian: debian linux; fedoraproject: fedora
References10
- roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 Vendor Advisory
- roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12 Vendor Advisory
- github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e2… PatchThird Party Advisory
- github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 Patch
- github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e2… PatchThird Party Advisory
- github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5 Patch
- github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965… ExploitThird Party Advisory
- github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965… ExploitThird Party Advisory
- github.com/roundcube/roundcubemail/releases/tag/1.3.12 Release Notes
- github.com/roundcube/roundcubemail/releases/tag/1.4.5 Release Notes
Metrics
- CVSS 3.1
-
6.1
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - EPSS — exploit probability
- 77% percentile: 100 · as of 2 November 2026
- CWE
- CWE-79CWE-80