CVE-2023-43770: Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: yes — in CISA KEV since 2024-02-12
EPSS: 63.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-22 · updated 2026-06-17
Weakness: CWE-79

Description

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

Affected products

Debian Linux: 10.0
Roundcube Webmail: before 1.4.14; from 1.5.0 before 1.5.4; from 1.6.0 before 1.6.3 — fixed in 1.4.14, 1.5.4, 1.6.3

How to fix

Upgrade to a fixed version: Roundcube Webmail 1.4.14, 1.5.4, 1.6.3. Check the vendor advisory for mitigations.

References

https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b
https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html
https://roundcube.net/news/2023/09/15/security-update-1.6.3-released
https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b
https://lists.debian.org/debian-lts-announce/2023/09/msg00024.html
https://roundcube.net/news/2023/09/15/security-update-1.6.3-released
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770

Get alerted when CVE-2023-43770 or the next vulnerability affects your stack