# Roundcube Webmail 0-Click Stored XSS (CVE-2026-54432, CVE-2026-54433) — Versions Prior to 1.6.17 / 1.7.2

> Roundcube Webmail versions prior to 1.6.17 and 1.7.2 contain two zero-click stored XSS vulnerabilities: CVE-2026-54432 executes arbitrary JavaScript via an unescaped attachment MIME type on the attachment-validation warning page, and CVE-2026-54433 injects malicious scripts that execute silently when a message is viewed in plain-text mode. Neither requires user interaction beyond opening or previewing an email.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1185
- **ID:** TL-2026-1185
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-54432, CVE-2026-54433

## Description

On 2026-07-05 the Roundcube project released security updates 1.6.17 and 1.7.2 patching six issues, two of which are zero-click stored cross-site scripting vulnerabilities reported by Bohdan Kurinnoy of Samsung R&D Institute Ukraine (SRUKR). CVE-2026-54432 stems from the attachment-validation warning page failing to escape the MIME type string associated with an uploaded/received attachment; because Roundcube renders this warning automatically when a message containing a suspicious or blocked attachment type is opened, an attacker who controls the MIME type field of a crafted attachment can inject and execute arbitrary JavaScript in the victim's webmail session the moment the warning page loads — no click, download, or explicit user action required beyond viewing the message. GitHub release notes for 1.6.17 describe the fix as making the attachment-validation warning page properly escape MIME type data (tracked upstream alongside issue #10193 for an unrelated TNEF fix in the same release). CVE-2026-54433 is a stored XSS in Roundcube's plain-text message rendering engine: content that should be rendered as inert text is instead interpreted and executed as script when the recipient views the message in plain-text mode, a mode users often trust as inherently safe from HTML-borne script injection, which defeats the visual/behavioral cues (e.g., 'blocked images' or 'view as HTML' prompts) users rely on to spot suspicious mail. Because Roundcube is server-rendered webmail, any script executing in the DOM runs in the authenticated session origin and can read the DOM, issue XHR/fetch requests using the victim's session cookie, exfiltrate mail contents, or, per community discussion of the disclosure, exfiltrate the session token itself to enable full account/mailbox takeover. Both CVEs were disclosed and patched simultaneously alongside four other Roundcube 1.6.17/1.7.2 fixes, per the vendor's own release notes and changelog: (1) an infinite loop in the TNEF (winmail.dat) decoder enabling a denial-of-service via malformed attachments (GitHub issue #10193, reported by stafra); (2) password-plugin vulnerabilities involving session-injected usernames (reported by Glendaenri and peppersghost); (3) two additional SSRF bypass cases exploitable via local-address URL formats (reported by Leenear); and (4) a denial-of-service via crafted compressed-RTF size values inside TNEF attachments (reported by h0rk1p). The same 1.6.17 release also shipped two unrelated feature additions (Enigma automatic public-key lookup via HKP v1, tracked as #5314, and Enigma Kolab WOAT support, #8626) that are not security-relevant to this threat. As of this research, NVD has not yet published CVSS scores for CVE-2026-54432/CVE-2026-54433 (empty NVD API results at time of analysis, confirmed via direct NVD REST query on 2026-07-10); no public PoC exploit code or confirmed in-the-wild exploitation has been identified for these two specific CVEs — CERT-FR's advisory (CERTFR-2026-AVI-0835) catalogs the same release's issues as a mix of security-bypass, DoS, SSRF, and XSS-via-indirect-code-injection categories without assigning independent severity beyond referencing the vendor bulletin. This is not Roundcube's first appearance on CISA's Known Exploited Vulnerabilities (KEV) catalog: in February 2026, CISA added two earlier, unrelated Roundcube flaws — CVE-2025-49113 (CVSS 9.9, deserialization-of-untrusted-data remote code execution for authenticated users, patched June 2025) and CVE-2025-68461 (CVSS 7.2, SVG-animate-tag cross-site scripting, patched December 2025) — to the KEV catalog after confirming active exploitation, with a federal remediation deadline of 2026-03-13. Neither CVE-2026-54432 nor CVE-2026-54433 currently appears in the KEV catalog, but the vendor's recurring cadence of XSS/RCE/SSRF findings and its history of rapid weaponization after disclosure (the CVE-2025-49113 RCE was reportedly weaponized within 48 hours of disclosure per prior reporting) elevate the urgency of patching even absent a CVSS score. Given the zero-click nature, the wide deployment of Roundcube as a self-hosted webmail platform (including bundled use in hosting-panel stacks such as DirectAdmin/cPanel), and the low complexity of exploitation described by the discloser, defenders should treat unpatched instances as high risk despite the absence of a formal CVSS score.

## MITRE ATT&CK

- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1505 Server Software Component
- T1211 Exploitation for Stealth
- T1539 Steal Web Session Cookie
- T1550 Use Alternate Authentication Material
- T1213 Data from Information Repositories
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1567 Exfiltration Over Web Service
- T1531 Account Access Removal
- T1588 Obtain Capabilities
- T1595 Active Scanning
- T1518 Software Discovery
- T1499 Endpoint Denial of Service

## Sources

- [Roundcube 0-Click Vulnerability Allows Attackers to Inject Malicious Scripts](https://cybersecuritynews.com/roundcube-0-click-vulnerability/)
- [Security updates 1.6.17 and 1.7.2 released](https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2)
- [Multiples vulnérabilités dans Roundcube - CERT-FR](https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0835)
- [Release Roundcube Webmail 1.6.17](https://github.com/roundcube/roundcubemail/releases/tag/1.6.17)
- [roundcubemail CHANGELOG.md](https://github.com/roundcube/roundcubemail/blob/master/CHANGELOG.md)
- [Roundcube 1.7.2 / 1.6.17 CVE discussion - DirectAdmin Forums](https://forum.directadmin.com/threads/roundcube-1-7-2-1-6-17-cve.82398/)
- [NVD CVE-2026-54432 record (pending publication)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54432)
- [NVD CVE-2026-54433 record (pending publication)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-54433)
- [CISA Adds Two Actively Exploited Roundcube Flaws to KEV Catalog (CVE-2025-49113, CVE-2025-68461)](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1185