Roundcube Webmail Cross-Site Scripting Vulnerability in HTML Attachment Preview

A cross-site scripting (XSS) vulnerability has been identified in Roundcube Webmail versions prior to 1.5.14 and 1.6.14. The issue arises from inadequate sanitization of HTML attachments in preview mode, allowing malicious content to be executed. To exploit this vulnerability, a victim must preview a text/html attachment.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users can update to Roundcube Webmail versions 1.5.14, 1.6.14, or 1.7-rc6, all of which include the necessary fix. Instructions for updating are available on the Roundcube website and GitHub release pages.