CVE-2024-57004: Roundcube Webmail

Medium severity, CVSS 6.1. EPSS: 28.8% chance of exploitation in the next 30 days.

Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote authenticated users to upload a malicious file as an email attachment, leading to the triggering of the XSS by visiting the SENT session.

Affected products

• Roundcube Webmail: version 1.6.9 only

Published 2025-02-03. Last modified 2026-06-17.