Medium 6.1Known exploited (CISA KEV)Published Oct 18, 2023

CVE-2023-5631Stored XSS vulnerability in Roundcube

Updated under an hour ago (Oct 27, 2026, 7:40 AM ET)

Does this affect you?

It affects Roundcubemail and 3 other products. Add what you run to find out whether that includes you.

CISA lists it as known exploited since Oct 26, 2023; federal agencies had to remediate by Nov 16, 2023. Treat that date as your deadline.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Roundcubemail

Exploited in the last 30 days

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.

CVSS: 6.1 MEDIUM (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness (CWE): CWE-79
Known exploited: Added to CISA KEV Oct 26, 2023; federal remediation due Nov 16, 2023Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
EPSS (exploitation in the next 30 days): 76.90% (percentile 100)
Assigned by: ESET
NVD analysis: Analyzed
Record last updated: Oct 21, 2025
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Roundcube Roundcubemail roundcube:roundcubemail (from the name)	from 1.6.0 before 1.6.3; from 1.5.0 before 1.5.4; from 1.4.0 before 1.5.14; 1.6.4 not affected; 1.5.5 not affected; 1.5.15 not affected	CNA record
roundcube webmail roundcube:webmail	before 1.4.15; from 1.5.0 before 1.5.5; from 1.6.0 before 1.6.4	NVD
debian debian_linux debian:debian_linux	10.0; 11.0; 12.0	NVD
fedoraproject fedora fedoraproject:fedora	39	NVD

References

References

https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613	patch
https://github.com/roundcube/roundcubemail/releases/tag/1.6.4	release-notes
https://github.com/roundcube/roundcubemail/releases/tag/1.5.5	release-notes
https://github.com/roundcube/roundcubemail/releases/tag/1.4.15	release-notes
https://github.com/roundcube/roundcubemail/issues/9168	exploit, issue-tracking
https://roundcube.net/news/2023/10/16/security-update-1.6.4-released	release-notes
https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d	patch
https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15	release-notes
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079	mailing-list, patch
https://www.debian.org/security/2023/dsa-5531	mailing-list
1–10 of 16

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.