CVE-2026-54433: Roundcube Webmail

Critical severity, CVSS 10.0. EPSS: 0.3% chance of exploitation in the next 30 days.

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

Affected products

• Roundcube Webmail: before 1.6.17 (fixed in 1.6.17); from 1.7.0, before 1.7.2 (fixed in 1.7.2)

Published 2026-07-14. Last modified 2026-07-17.