CVE-2018-19206

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 55.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-11-12 · updated 2026-06-17
Weakness: CWE-79

Description

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

Affected products

Debian Linux: 9.0
Roundcube Webmail: before 1.3.8 — fixed in 1.3.8

How to fix

Upgrade to a fixed version: Roundcube Webmail 1.3.8. Check the vendor advisory for mitigations.

References

https://github.com/roundcube/roundcubemail/releases/tag/1.3.8
https://roundcube.net/news/2018/10/26/update-1.3.8-released
https://www.debian.org/security/2018/dsa-4344
https://github.com/roundcube/roundcubemail/releases/tag/1.3.8
https://roundcube.net/news/2018/10/26/update-1.3.8-released
https://www.debian.org/security/2018/dsa-4344

Get alerted when CVE-2018-19206 or the next vulnerability affects your stack