CVE-2018-19206: Debian Linux

Medium severity, CVSS 6.1. EPSS: 55.9% chance of exploitation in the next 30 days.

steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.

Affected products

• Debian Debian Linux: version 9.0 only
• Roundcube Webmail: before 1.3.8 (fixed in 1.3.8)

Published 2018-11-12. Last modified 2026-06-17.