Every CVE Search/ Get API key

CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a...

9.3 CriticalIn KEVPublic exploitFix available

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

82.9%Up 82.8 points since Aug 6, 2024
90%50%10%1%

What each source reports

NVD Score used 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
CVE-2024-42009
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
CVE-2024-42009
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2024-39391 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
EUVD-2024-39391
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-j43g-prf4-578j 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a...

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
GHSA-j43g-prf4-578j
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Weakness
CWE-79
Updated
2026-11-02
CISA KEV No score

RoundCube Webmail Cross-Site Scripting Vulnerability

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
CVE-2024-42009
Weakness
CWE-79
Updated
2026-11-02
OSV 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
CVE-2024-42009
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2024-42009 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
DEBIAN-CVE-2024-42009
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2024-42009 9.3

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Record
UBUNTU-CVE-2024-42009
CVSS 3.1
9.3 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
Updated
2026-11-02
OSVMGASA-2024-0279 No score

Updated roundcubemail packages fix security vulnerabilities

Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

Record
MGASA-2024-0279
Updated
2026-11-02
OSVopenSUSE-SU-2024:0328-1 No score

Security update for roundcubemail

This update for roundcubemail fixes the following issues:

Update to 1.6.8 This is a security update to the stable version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities:

  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]

CHANGELOG

  • Managesieve: Protect special scripts in managesieve_kolab_master mode
  • Fix newmail_notifier notification focus in Chrome (#9467)
  • Fix fatal error when parsing some TNEF attachments (#9462)
  • Fix double scrollbar when composing a mail with many plain text lines (#7760)
  • Fix decoding mail parts with multiple base64-encoded text blocks (#9290)
  • Fix bug where some messages could get malformed in an import from a MBOX file (#9510)
  • Fix invalid line break characters in multi-line text in Sieve scripts (#9543)
  • Fix bug where 'with attachment' filter could fail on some fts engines (#9514)
  • Fix bug where an unhandled exception was caused by an invalid image attachment (#9475)
  • Fix bug where a long subject title could not be displayed in some cases (#9416)
  • Fix infinite loop when parsing malformed Sieve script (#9562)
  • Fix bug where imap_conn_option's 'socket' was ignored (#9566)
  • Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
  • Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
  • Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
Record
openSUSE-SU-2024:0328-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:14243-1 No score

roundcubemail-1.6.8-1.1 on GA media

These are all security issues fixed in the roundcubemail-1.6.8-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:14243-1
Updated
2026-11-02
OSVUSN-7636-1 No score

roundcube vulnerability

It was discovered that Roundcube Webmail incorrectly handled sanitization in the message_body function. A remote attacker could possibly use this issue to send and receive emails as another user.

Record
USN-7636-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
roundcube
Debian:12
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:13
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:14
 before 1.6.8+dfsg-1
1.6.8+dfsg-1
roundcube
Debian:12
From an advisory covering 3 CVEs
 before 1.6.5+dfsg-1+deb12u3, plus listed versions
1.6.1+dfsg-11.6.2+dfsg-11.6.3+dfsg-11.6.3+dfsg-1~deb12u11.6.3+dfsg-2
Show 5 moreShow less
1.6.4+dfsg-11.6.4+dfsg-1~deb12u11.6.5+dfsg-11.6.5+dfsg-1+deb12u21.6.5+dfsg-1~deb12u1
1.6.5+dfsg-1+deb12u3
roundcube
Debian:11
From an advisory covering 3 CVEs
 before 1.4.15+dfsg.1-1+deb11u4, plus listed versions
1.4.11+dfsg.1-41.4.12+dfsg.1-1~bpo10+11.4.12+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u11.4.13+dfsg.1-1~deb11u1~bpo10+1
Show 7 moreShow less
1.4.14+dfsg.1-1~deb11u11.4.14+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1+deb11u31.4.15+dfsg.1-1~deb11u11.4.15+dfsg.1-1~deb11u1~bpo10+11.4.15+dfsg.1-1~deb11u21.4.15+dfsg.1-1~deb11u2~bpo10+1
1.4.15+dfsg.1-1+deb11u4
roundcubemail
Mageia:9
From an advisory covering 3 CVEs
 before 1.6.8-1.mga9
1.6.8-1.mga9
roundcube
Ubuntu:Pro:24.04:LTS
 before 1.6.6+dfsg-2ubuntu0.1+esm1, plus listed versions
1.6.2+dfsg-11.6.4+dfsg-11.6.5+dfsg-11.6.6+dfsg-11.6.6+dfsg-21.6.6+dfsg-2ubuntu0.1
1.6.6+dfsg-2ubuntu0.1+esm1
roundcubemail
SUSE:Package Hub 15 SP5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
SUSE:Package Hub 15 SP6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.5
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Leap 15.6
From an advisory covering 3 CVEs
 before 1.6.8-bp156.2.3.1
1.6.8-bp156.2.3.1
roundcubemail
openSUSE:Tumbleweed
From an advisory covering 3 CVEs
 before 1.6.8-1.1
1.6.8-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHub0xbassiouny1337/CVE-2024-420092025-02-11
PoC in GitHubBhanunamikaze/CVE-2024-420092025-02-13
PoC in GitHubDaniTheHack3r/CVE-2024-42009-PoC2025-05-24
PoC in GitHubShubhankargupta691/CVE-2024-420092025-09-14
PoC in GitHubZaidArif47/CVE-2024-420092026-04-16
PoC in GitHubsegunakinsoyinu/CVE-2024-42009-roundcube-xss2026-06-17
NucleiRoundcube Webmail - Cross-Site Scripting

History

History
RecordedChangedSources
affected
exploitation, exploits
first indexedCVE List, EUVD, GitHub Advisories, CISA KEV, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-42009 is a critical vulnerability (CVSS 9.3) in Roundcube Webmail, published August 5, 2024. CISA lists it as known to be exploited, since June 9, 2025. EUVD reports exploitation since June 9, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.9%, the 99th percentile. Fixed in roundcube 1.6.5+dfsg-1+deb12u3.

References

Show 17 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open