{"id":"CVE-2023-5631","aliases":["BIT-roundcube-2023-5631","DEBIAN-CVE-2023-5631","DLA-3630-1","DSA-5531-1","EUVD-2023-57924","GHSA-qf8f-27cp-gw76","MGASA-2023-0332","UBUNTU-CVE-2023-5631","USN-6848-1","openSUSE-SU-2023:0345-1","openSUSE-SU-2024:13365-1"],"status":"published","title":"Stored XSS vulnerability in Roundcube","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.76337,"percentile":0.99545,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2023-10-18T14:51:18Z","modified":"2026-10-28T02:30:34Z","kev":{"date_added":"2023-10-26","due_date":"2023-11-16","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2023-10-26"},{"source":"kev","since":"2023-10-26"}],"fixes":[{"ecosystem":"Bitnami","package":"roundcube","fixed_in":["1.4.15","1.5.5","1.6.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.6.4+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.6.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.6.4+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:10","package":"roundcube","fixed_in":["1.3.17+dfsg.1-1~deb10u4"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"roundcube","fixed_in":["1.4.15+dfsg.1-1~deb11u1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","fixed_in":["1.4.3+dfsg.1-1ubuntu0.1~esm4"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","fixed_in":["1.5.0+dfsg.1-2ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","fixed_in":["1.6.4-bp155.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","fixed_in":["1.6.4-bp155.2.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","fixed_in":["1.6.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"roundcube","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.15"},{"introduced":"1.5.0"},{"fixed":"1.5.5"},{"introduced":"1.6.0"},{"fixed":"1.6.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4+dfsg-1~deb12u1"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2"]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.17+dfsg.1-1~deb10u4"}]}],"versions":["1.3.10+dfsg.1-1","1.3.10+dfsg.1-1~deb10u1","1.3.11+dfsg.1-1~deb10u1","1.3.13+dfsg.1-1~deb10u1","1.3.14+dfsg.1-1~deb10u1","1.3.15+dfsg.1-1~deb10u1","1.3.16+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u1","1.3.17+dfsg.1-1~deb10u2","1.3.17+dfsg.1-1~deb10u3","1.3.8+dfsg.1-2"]},{"source":"osv","ecosystem":"Debian:11","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.15+dfsg.1-1~deb11u1"}]}],"versions":["1.4.11+dfsg.1-4","1.4.12+dfsg.1-1~bpo10+1","1.4.12+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1","1.4.13+dfsg.1-1~deb11u1~bpo10+1","1.4.14+dfsg.1-1~deb11u1","1.4.14+dfsg.1-1~deb11u1~bpo10+1","1.4.15+dfsg.1-1~deb11u1~bpo10+1"]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4+dfsg-1~deb12u1"}]}],"versions":["1.6.1+dfsg-1","1.6.2+dfsg-1","1.6.3+dfsg-1","1.6.3+dfsg-1~deb12u1","1.6.3+dfsg-2"]},{"source":"osv","ecosystem":"Mageia:9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5-1.mga9"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm4"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.0+dfsg.1-1","1.3.1+dfsg.1-1","1.3.3+dfsg.1-1","1.3.3+dfsg.1-2","1.3.6+dfsg.1-1","1.3.6+dfsg.1-1ubuntu0.1~esm1","1.3.6+dfsg.1-1ubuntu0.1~esm2","1.3.6+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.3+dfsg.1-1ubuntu0.1~esm4"}]}],"versions":["1.3.8+dfsg.1-2","1.3.10+dfsg.1-1","1.4.1+dfsg.1-2","1.4.2+dfsg.1-1","1.4.2+dfsg.1-2","1.4.3+dfsg.1-1","1.4.3+dfsg.1-1ubuntu0.1~esm1","1.4.3+dfsg.1-1ubuntu0.1~esm2","1.4.3+dfsg.1-1ubuntu0.1~esm3"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.0+dfsg.1-2ubuntu0.1~esm3"}]}],"versions":["1.4.11+dfsg.1-4","1.5.0+dfsg.1-2","1.5.0+dfsg.1-2ubuntu0.1~esm1","1.5.0+dfsg.1-2ubuntu0.1~esm2"],"bundled":4},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-bp155.2.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.4-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"roundcube","product":"roundcubemail"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/commit/6ee6e7ae301e165e2b2cb703edf75552e5376613","tags":["x_transferred","Patch","web","fix","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.4","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.5.5","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.4.15","tags":["x_transferred","Release Notes","web","report"]},{"url":"https://github.com/roundcube/roundcubemail/issues/9168","tags":["x_transferred","Exploit","Issue Tracking","web","report"]},{"url":"https://roundcube.net/news/2023/10/16/security-update-1.6.4-released","tags":["x_transferred","Release Notes","web"]},{"url":"https://github.com/roundcube/roundcubemail/commit/41756cc3331b495cc0b71886984474dc529dd31d","tags":["x_transferred","Patch","web","fix","report"]},{"url":"https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15","tags":["x_transferred","Release Notes","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1054079","tags":["x_transferred","Mailing List","Patch","web"]},{"url":"https://www.debian.org/security/2023/dsa-5531","tags":["x_transferred","Mailing List","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00035.html","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/1","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/01/3","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4/","tags":["x_transferred","Mailing List","web"]},{"url":"http://www.openwall.com/lists/oss-security/2023/11/17/2","tags":["x_transferred","Mailing List","Third Party Advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631","tags":["government-resource","US Government Resource","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5631","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LK67Q46OIEGJCRQUBHKLH3IIJTBNGGX4"},{"url":"https://github.com/advisories/GHSA-qf8f-27cp-gw76"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/5xxx/CVE-2023-5631.json","tags":["advisory"]},{"url":"https://github.com/roundcube/roundcubemail","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-5631","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2023-0332.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=32493","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.5","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-5631","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5631","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6848-1","tags":["advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-47272","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-37383","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2024-37384","tags":["report"]},{"url":"https://launchpad.net/bugs/2043396","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/GGRBYUWS4WS3V7Z75JPLZ6VMUDQER3SA/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1216429","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-5631","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-5631","title":"Stored XSS vulnerability in Roundcube","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","status":"published","published":"2023-10-18T14:51:18.443Z","modified":"2025-10-21T23:05:34.074Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:17.149492Z"}],"euvd":[{"id":"EUVD-2023-57924","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","status":"published","published":"2023-10-18T14:51:18Z","modified":"2025-10-21T23:05:34Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"exploited_since":"2023-10-26","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-qf8f-27cp-gw76","title":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML...","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","status":"published","published":"2023-10-18T15:30:24Z","modified":"2025-10-22T00:32:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:04:07.112106Z"}],"kev":[{"id":"CVE-2023-5631","title":"Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability","description":"Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.","cwes":["CWE-79"],"kev":{"date_added":"2023-10-26","due_date":"2023-11-16","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-5631","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","status":"published","published":"2023-10-18T15:15:08.727Z","modified":"2026-06-17T06:48:58.673Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:08:39.058878Z"}],"osv":[{"id":"CVE-2023-5631","title":"Stored XSS vulnerability in Roundcube","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker\n\nto load arbitrary JavaScript code.","status":"published","published":"2023-10-18T14:51:18.443Z","modified":"2026-10-28T02:30:34.405034885Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:44:36.851042Z"},{"id":"DEBIAN-CVE-2023-5631","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker  to load arbitrary JavaScript code.","status":"published","published":"2023-10-18T15:15:08.727Z","modified":"2026-10-26T18:03:10.578330487Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:41.533064Z"},{"id":"UBUNTU-CVE-2023-5631","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.","status":"published","published":"2023-10-18T15:15:00Z","modified":"2026-02-04T03:14:18.639407Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:54:41.555387Z"},{"id":"BIT-roundcube-2023-5631","description":"Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attackerto load arbitrary JavaScript code.","status":"published","published":"2024-03-06T11:03:55.977Z","modified":"2024-03-06T11:25:28.861Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DLA-3630-1","title":"roundcube - security update","status":"published","published":"2023-10-24T00:00:00Z","modified":"2026-03-09T01:20:21.82402Z","updated_at":"2026-11-02T15:46:12.203458Z"},{"id":"DSA-5531-1","title":"roundcube - security update","status":"published","published":"2023-10-23T00:00:00Z","modified":"2026-03-09T02:09:21.596149Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"MGASA-2023-0332","title":"Updated roundcubemail packages fix XSS security vulnerabilities","description":"Updated roundcubemail package fixes security vulnerabilities:\n\nFix cross-site scripting (XSS) vulnerability in setting Content-Type/\nContent-Disposition for attachment preview/download (CVE-2023-47272)\n\nFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML\nmessages. (CVE-2023-5631)\n\nSome other errors have been fixed:\n- Fix PHP8 fatal error when parsing a malformed BODYSTRUCTURE\n- Fix duplicated Inbox folder on IMAP servers that do not use Inbox\n  folder with all capital letters\n- Fix PHP warnings\n- Fix UI issue when dealing with an invalid managesieve_default_headers\n  value\n- Fix bug where images attached to application/smil messages weren't\n  displayed\n- Fix PHP string replacement error in utils/error.php\n- Fix regression where smtp_user did not allow pre/post strings\n  before/after %u placeholder\n","status":"published","published":"2023-12-01T11:54:47Z","modified":"2026-04-16T04:42:18.383637496Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2023:0345-1","title":"Security update for roundcubemail","description":"This update for roundcubemail fixes the following issues:\n\nUpdate to version 1.6.4 (boo#1216429):\n\n* CVE-2023-5631: Fix cross-site scripting vulnerability in handling of SVG in HTML messages \n* Fix PHP8 warnings\n* Fix default 'mime.types' path on Windows\n* Managesieve: Fix javascript error when relational or spamtest extension is not enabled\n","status":"published","published":"2023-11-02T11:05:52Z","modified":"2026-02-04T03:44:02.77443Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13365-1","title":"roundcubemail-1.6.4-1.1 on GA media","description":"These are all security issues fixed in the roundcubemail-1.6.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:50.419681Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"USN-6848-1","title":"roundcube vulnerabilities","description":"Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly\nhandled certain SVG images. A remote attacker could possibly use this\nissue to load arbitrary JavaScript code. This issue only affected Ubuntu\n18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.\n(CVE-2023-5631)\n\nRene Rehme discovered that Roundcube incorrectly handled certain headers.\nA remote attacker could possibly use this issue to load arbitrary\nJavaScript code. This issue only affected Ubuntu 20.04 LTS,\nUbuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)\n\nValentin T. and Lutz Wolf discovered that Roundcube incorrectly handled\ncertain SVG images. A remote attacker could possibly use this issue to\nload arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,\nUbuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)\n\nHuy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled\ncertain fields in user preferences. A remote attacker could possibly use\nthis issue to load arbitrary JavaScript code. (CVE-2024-37384)\n","status":"published","published":"2024-06-25T18:16:54Z","modified":"2026-06-25T13:32:28.795533862Z","updated_at":"2026-11-02T16:58:17.914523Z"}]}}