Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

Roundcube Email Client XSS Vulnerability

CVE-2021-26925 · published 5 years ago
Summary

A security issue in Roundcube's email rendering allows hackers to inject malicious code into emails. This could allow them to steal sensitive information or take control of user accounts. Update to the latest version of Roundcube to fix this issue.

What to do
  • Update debian roundcube to version 1.4.11+dfsg.1-1.
  • Update roundcube webmail to version 1.4.11 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian roundcube < 1.4.11+dfsg.1-1
Fix: upgrade to 1.4.11+dfsg.1-1
Debian:12 debian roundcube < 1.4.11+dfsg.1-1
Fix: upgrade to 1.4.11+dfsg.1-1
Debian:13 debian roundcube < 1.4.11+dfsg.1-1
Fix: upgrade to 1.4.11+dfsg.1-1
Debian:14 debian roundcube < 1.4.11+dfsg.1-1
Fix: upgrade to 1.4.11+dfsg.1-1
– roundcube webmail < 1.4.11
cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
– fedoraproject fedora 32
33
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
Original advisory text
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.4 Medium
Exploitation
1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published9 Feb 2021
Updated4 Nov 2026
First seen29 May 2026
Sources
DEBIAN-CVE-2021-26925 · OSV
CVE-2021-26925 · NVD
Track software like this
Free during beta