Roundcube Webmail Cross-Site Scripting (XSS) via Malicious XML Attachment (CVE-2020-13965)
Executive & SecOps Summary
SECOPS ASSESSMENTRoundcube Webmail versions before 1.3.12 and 1.4.x before 1.4.5
Attackers can execute arbitrary JavaScript in the victim's browser session via a malicious XML attachment preview, leading to session hijacking
Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Roundcube Webmail to the latest secure release (1.3.12, 1.4.5, or newer). Use the following commands to perform the upgrade:
# Navigate to the Roundcube installation directory
cd /var/www/roundcube
# Download the secure release package
wget https://github.com/roundcube/roundcubemail/releases/download/1.4.5/roundcubemail-1.4.5-complete.tar.gz
tar -zxvf roundcubemail-1.4.5-complete.tar.gz
# Run the official upgrade installer script
cd roundcubemail-1.4.5
./bin/installto.sh /var/www/roundcube2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, mitigate the risk by disabling inline previews for XML files in the configuration file (config/config.inc.php).
// Edit config/config.inc.php
// Ensure 'text/xml' and 'application/xml' are excluded from inline preview allowed mime-types
$config['mime_types'] = array(
'text/html' => 'html',
// Ensure XML mappings are removed or forced to download
);3. Log Audit & IoC Verification Commands
Search web server access logs for potential exploitation attempts where users were tricked into previewing XML attachments.
# Search access logs for XML attachment preview requests
grep -Ei 'action=get.*mime_id.*\.xml' /var/log/nginx/access.log /var/log/apache2/access.log 2>/dev/null
# Verify the currently running Roundcube version
grep 'RCMAIL_VERSION' /var/www/roundcube/program/include/iniset.php 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2020-13965) is a stored/reflected Cross-Site Scripting (XSS) flaw in Roundcube Webmail. The root cause lies in how the application handles email attachment previews. Roundcube included 'text/xml' in its list of allowed mime-types for inline previewing without properly sanitizing or sandboxing active content (such as JavaScript or SVG scripts embedded within XML CDATA sections).
2. Exploitation Mechanics & Attack Scenario
An attacker sends an email containing a specially crafted XML attachment to the target user. When the user clicks the 'Preview' button for the XML attachment within the Roundcube web interface, the server serves the file with a 'Content-Type: text/xml' header. The browser renders the XML document and executes any embedded malicious scripts within the context of the Roundcube application session, allowing the attacker to steal session tokens or perform unauthorized actions.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it has been actively exploited in the wild. Successful exploitation allows attackers to compromise user mailboxes, exfiltrate sensitive corporate communications, and potentially pivot to launch secondary phishing campaigns impersonating legitimate internal users.
Official Vendor Advisories & References
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Frequently Asked SecOps Questions (CVE-2020-13965)
FAQQ1. How critical is CVE-2020-13965 and is it actively exploited in the wild?
CVE-2020-13965 is rated CVSS 6.1 (MEDIUM) with a 30-day EPSS exploitation probability of 76.6%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-13965?
Primary impacted vendors include roundcube across roundcube_webmail. Scope summary: Roundcube Webmail versions prior to 1.3.12 and 1.4.x versions prior to 1.4.5
Q3. What temporary mitigations or workarounds exist for CVE-2020-13965 before patching?
[Mitigation] Immediately upgrade Roundcube Webmail to patched versions 1.3.12, 1.4.5, or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-13965
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (roundcube)
View Category →Microsoft Exchange Server Cross-Site Scripting (XSS) and Spoofing Vulnerability Advisory (CVE-2026-42897)
[Affected Scope] All supported on-premises Microsoft Exchange Server environments.
CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory
[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4
WordPress SureCart Plugin Stored XSS Vulnerability (CVE-2026-107653) Security Advisory
[Affected Scope] All versions up to, and including, 4.9.4 of the SureCart WordPress plugin
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.