Aller au contenu
Se connecter
4.7 Moyenne

CVE-2026-54432 Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS)

Description

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.

Produits et versions touchés

Produit Versions touchées Corrigé en
Webmail 1.7 1.7.0 → < 1.7.2 1.7.2
Webmail 1.6 1.6.0 → < 1.6.17 1.6.17

Autres CVE de Webmail

Les 62 CVE de Webmail →
CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in… 6.8 Moyenne CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability… 5.3 Moyenne CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass 7.2 Élevée CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass 5.3 Moyenne
Suivre cette CVE