Disclosure summary
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
CISA remediation guidance
Apply updates per vendor instructions.
Original records & references
PUBLISHED 2023-06-22T00:00:00-04:00
MODIFIED 2023-06-22T00:00:00-04:00
INGESTED 2026-10-06T11:42:58-04:00