CVE-2021-46144
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted...
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
CVE-2021-46144- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
CVE-2021-46144- Updated
- 2026-11-02
EUVDEUVD-2021-32844 No score
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
EUVD-2021-32844- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8373-wxqf-ph2h
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted...
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
GHSA-8373-wxqf-ph2h- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
CVE-2021-46144- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-46144
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
DEBIAN-CVE-2021-46144- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-46144
Roundcube before 1.4.13 and 1.5.x before 1.5.2 allows XSS via an HTML e-mail message with crafted Cascading Style Sheets (CSS) token sequences.
- Record
UBUNTU-CVE-2021-46144- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUSN-5182-1 No score
roundcube vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present in the CDATA of an HTML message. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)
It was discovered that Roundcube Webmail incorrectly processed login and logout POST requests. An attacker could possibly use this issue to launch a cross-site request forgery (CSRF) attack and force an authenticated user to be logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12626)
It was discovered that Roundcube Webmail incorrectly processed new plugin names in rcube_plugin_api.php. An attacker could possibly use this issue to obtain sensitive information from local files or to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12640)
It was discovered that Roundcube Webmail did not sanitize shell metacharacters recovered from variables in its configuration settings. An attacker could possibly use this issue to execute arbitrary code in the server. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12641)
It was discovered that Roundcube Webmail incorrectly sanitized characters in the username template object. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13964)
It was discovered that Roundcube Webmail allowed preview of text/html content. A remote attacker could possibly use this issue to send a malicious XML attachment via an email message and execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13965)
Andrea Cardaci discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained an SVG element in the XML namespace. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15562)
Lukasz Pilorz discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained SVG documents. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-16145)
Alex Birnberg discovered that Roundcube Webmail incorrectly sanitized characters in plain text e-mail messages that included link reference elements. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-35730)
It was discovered that Roundcube Webmail did not properly sanitize HTML special characters in warning messages that contained an attachment's filename extension. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44025)
It was discovered that Roundcube Webmail incorrectly managed session variables related to search functionalities. A remote attacker could possibly use this issue to execute a SQL injection attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44026)
It was discovered that Roundcube Webmail did not properly sanitize HTML special characters when dealing with HTML messages that contained CSS content. A remote attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM, Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-46144)
- Record
USN-5182-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubeDebian:12 |
before 1.6.0+dfsg-1 | 1.6.0+dfsg-1 |
roundcubeDebian:13 |
before 1.6.0+dfsg-1 | 1.6.0+dfsg-1 |
roundcubeDebian:14 |
before 1.6.0+dfsg-1 | 1.6.0+dfsg-1 |
roundcubeDebian:9 |
before 1.2.3+dfsg.1-4+deb9u10, plus listed versions 1.2.3+dfsg.1-41.2.3+dfsg.1-4+deb9u11.2.3+dfsg.1-4+deb9u21.2.3+dfsg.1-4+deb9u31.2.3+dfsg.1-4+deb9u4 Show 5 moreShow less1.2.3+dfsg.1-4+deb9u51.2.3+dfsg.1-4+deb9u61.2.3+dfsg.1-4+deb9u71.2.3+dfsg.1-4+deb9u81.2.3+dfsg.1-4+deb9u9 |
1.2.3+dfsg.1-4+deb9u10 |
roundcubeDebian:10 |
before 1.3.17+dfsg.1-1~deb10u2, plus listed versions 1.3.10+dfsg.1-11.3.10+dfsg.1-1~deb10u11.3.11+dfsg.1-1~deb10u11.3.13+dfsg.1-1~deb10u11.3.14+dfsg.1-1~deb10u1 Show 4 moreShow less1.3.15+dfsg.1-1~deb10u11.3.16+dfsg.1-1~deb10u11.3.17+dfsg.1-1~deb10u11.3.8+dfsg.1-2 |
1.3.17+dfsg.1-1~deb10u2 |
roundcubeDebian:11 |
before 1.4.13+dfsg.1-1~deb11u1, plus listed versions 1.4.11+dfsg.1-41.4.12+dfsg.1-1~bpo10+11.4.12+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u1~bpo10+1 |
1.4.13+dfsg.1-1~deb11u1 |
roundcubeUbuntu:Pro:18.04:LTS |
before 1.3.6+dfsg.1-1ubuntu0.1~esm2, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-11.3.6+dfsg.1-1ubuntu0.1~esm1 |
1.3.6+dfsg.1-1ubuntu0.1~esm2 |
roundcubeUbuntu:Pro:20.04:LTS |
before 1.4.3+dfsg.1-1ubuntu0.1~esm2, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-21.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm1 |
1.4.3+dfsg.1-1ubuntu0.1~esm2 |
roundcubeUbuntu:Pro:22.04:LTS |
before 1.5.0+dfsg.1-2ubuntu0.1~esm1, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-2 |
1.5.0+dfsg.1-2ubuntu0.1~esm1 |
roundcubeUbuntu:Pro:16.04:LTS From an advisory covering 12 CVEs |
before 1.2~beta+dfsg.1-0ubuntu1+esm2, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu11.2~beta+dfsg.1-0ubuntu1+esm1 |
1.2~beta+dfsg.1-0ubuntu1+esm2 |
roundcubeUbuntu:Pro:18.04:LTS From an advisory covering 12 CVEs |
before 1.3.6+dfsg.1-1ubuntu0.1~esm2, plus listed versions 1.3.0+dfsg.1-11.3.1+dfsg.1-11.3.3+dfsg.1-11.3.3+dfsg.1-21.3.6+dfsg.1-11.3.6+dfsg.1-1ubuntu0.1~esm1 |
1.3.6+dfsg.1-1ubuntu0.1~esm2 |
roundcubeUbuntu:Pro:20.04:LTS From an advisory covering 12 CVEs |
before 1.4.3+dfsg.1-1ubuntu0.1~esm2, plus listed versions 1.3.8+dfsg.1-21.3.10+dfsg.1-11.4.1+dfsg.1-21.4.2+dfsg.1-11.4.2+dfsg.1-21.4.3+dfsg.1-11.4.3+dfsg.1-1ubuntu0.1~esm1 |
1.4.3+dfsg.1-1ubuntu0.1~esm2 |
roundcubeUbuntu:Pro:22.04:LTS From an advisory covering 12 CVEs |
before 1.5.0+dfsg.1-2ubuntu0.1~esm1, plus listed versions 1.4.11+dfsg.1-41.5.0+dfsg.1-2 |
1.5.0+dfsg.1-2ubuntu0.1~esm1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-46144 is a medium vulnerability (CVSS 6.1) in Roundcube, published January 6, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.08%, the 65th percentile. Fixed in roundcube 1.6.0+dfsg-1.
References
github.com/roundcube/roundcubemail/commit/8894fddd59b770399eed4ef8d4da5773913b5bf0
roundcube.net/news/2021/12/30/update-1.5.2-released
bugs.debian.org/1003027
debian.org/security/2022/dsa-5037
Show 18 moreShow less
lists.debian.org/debian-lts-announce/2022/01/msg00005.html
nvd.nist.gov/vuln/detail/CVE-2021-46144
security-tracker.debian.org/tracker/CVE-2021-46144
ubuntu.com/security/CVE-2021-46144
cve.org/CVERecord?id=CVE-2021-46144