Roundcube Webmail Security Update Patches Critical Zero-Click XSS and SSRF Bypass Flaws

Roundcube has released version 1.7.2, a security-focused update that addresses multiple high-impact vulnerabilities, including a zero-click stored cross-site scripting (XSS) flaw and a server-side request forgery (SSRF) bypass.

This update follows responsible disclosures from various security researchers and is strongly recommended for all production deployments.

Roundcube Webmail Security Update Patches Flaw

The most critical issue in this update, tracked as CVE-2026-54433, is a zero-click stored XSS vulnerability affecting Roundcube’s plain-text email rendering.

This flaw allows attackers to inject malicious JavaScript into emails that executes automatically upon viewing, without requiring any user interaction. Because exploitation does not depend on user clicks, it significantly increases the risk of session hijacking, credential theft, and arbitrary actions within a victim’s webmail session.

Another high-severity flaw, CVE-2026-54432, involves stored XSS triggered by improperly sanitized attachment MIME types on the attachment validation warning page. Attackers can create malicious attachments that bypass input validation, resulting in script execution when users interact with warning prompts.

In addition to the XSS vulnerabilities, the update resolves two newly identified SSRF bypass techniques. These vulnerabilities allow attackers to manipulate URL parsing logic to access restricted local or internal network resources.

SSRF vulnerabilities are especially dangerous in webmail environments, as they can enable attackers to pivot to internal services or exfiltrate sensitive metadata from backend systems.

The release also addresses multiple security weaknesses in the password plugin caused by session-injected usernames. These issues could potentially allow unauthorized password modifications or privilege escalation under certain circumstances.

Further security fixes include a denial-of-service (DoS) vulnerability caused by crafted compressed RTF data within TNEF (winmail.dat) attachments. Exploitation could lead to excessive resource consumption or service disruption. Additionally, an infinite loop bug in the TNEF decoder has been patched to prevent potential service hangs during email parsing.

Beyond security patches, Roundcube 1.7.2 includes several stability and performance improvements. These enhancements include fixes to the static.php handler, improved OAuth claim handling, corrections to Range request processing, and bug fixes affecting vCard imports, session storage behavior, and Imagick temporary file handling.

The maintainers have labeled version 1.7.2 as stable and urge administrators to upgrade immediately. As with any production update, users are advised to back up their configurations and data before deployment.

A practical exploitation scenario underscores the risk: an attacker sends a specially crafted email containing embedded malicious payloads. When the recipient opens the message in Roundcube, the zero-click XSS executes automatically, allowing the attacker to hijack the session and access the mailbox contents without any visible indication.

Given Roundcube’s widespread use in enterprise and hosting environments, these vulnerabilities pose a significant threat. Prompt patching, along with email filtering and web application hardening, is essential to mitigate potential attacks.

Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN