CVE-2026-54433: Roundcube Webmail: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scri…
Critical 10.0 EPSS 0.4% Roundcube Webmail
In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).
- CVE-2026-54433CVE identifier
- 10.0CVSS 3.1 base score (critical)
- 0.4%EPSS: chance of exploitation in the next 30 days (higher than 31% of CVEs)
- 2026-07-14published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Roundcube Webmail and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reload PHP-FPM / the web server after updating; check plugins and run bin/update.sh for tarball installs
Affected and fixed versions
Affected:
- Roundcube Webmail 1.6.0 to before 1.6.17
- Roundcube Webmail 1.7.0 to before 1.7.2
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade roundcube-coreUbuntu
sudo apt update
sudo apt install --only-upgrade roundcube-coreRHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh roundcubemail (EPEL)Fedora
sudo dnf upgrade --refresh roundcubemailSUSE / openSUSE
sudo zypper refresh
sudo zypper update roundcubemailAmazon Linux
not in distro repos: vendor repositoryArch Linux
sudo pacman -SyuAlpine
not packaged: upstream tarballFreeBSD
pkg update && pkg upgrade roundcube-php84 (roundcube-phpXY)General update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | roundcube | fixed | 1.6.5+dfsg-1+deb12u10 |
| Debian 13 | roundcube | fixed | 1.6.17+dfsg-0+deb13u1 |
| Debian testing | roundcube | fixed | 1.6.17+dfsg-1 |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
- CVE-2026-54433 on CVE.org
- CVE-2026-54433 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.