Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability Advisory (CVE-2020-35730)
Executive & SecOps Summary
SECOPS ASSESSMENTRoundcube Webmail versions before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10
Remote attackers can execute arbitrary JavaScript in the victim's browser session by sending a specially crafted plain text email, potentially leading to session hijacking
Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade Roundcube Webmail to the latest patched release. Use the following commands to back up and upgrade your installation:
# 1. Backup current installation
tar -czvf roundcube-backup-$(date +%F).tar.gz /var/www/roundcube
# 2. Download and extract the patched version (e.g., 1.4.10)
wget https://github.com/roundcube/roundcubemail/releases/download/1.4.10/roundcubemail-1.4.10-complete.tar.gz
tar -xzvf roundcubemail-1.4.10-complete.tar.gz
# 3. Run the official upgrade script
cd roundcubemail-1.4.10
./bin/installto.sh /var/www/roundcube2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, implement strict Content Security Policy (CSP) headers in your web server configuration to mitigate the impact of XSS execution:
# Add to your Nginx server block
add_header X-XSS-Protection '1; mode=block' always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline';" always;3. Log Audit & IoC Verification Commands
Verify the currently installed version of Roundcube and inspect web server logs for potential exploitation attempts:
# Check Roundcube version
grep "RCMAIL_VERSION" /var/www/roundcube/program/include/iniset.php
# Scan web server logs for suspicious script patterns in requests
grep -Ei 'javascript:|script|<iframe' /var/log/nginx/access.log /var/log/apache2/access.logBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
A Cross-Site Scripting (XSS) vulnerability exists in Roundcube Webmail due to improper input sanitization. The root cause lies within the linkref_addindex function in program/lib/Roundcube/rcube_string_replacer.php, which fails to properly sanitize and escape link reference elements when parsing plain text email messages.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a plain text email containing malicious JavaScript embedded within a link reference element. When the victim opens and views the email, the linkref_addindex function processes the link reference and renders it into the HTML DOM without proper escaping. This allows the attacker's JavaScript payload to execute within the context of the victim's active Roundcube session, enabling session hijacking, credential theft, or unauthorized actions on behalf of the user.
3. Infrastructure & Business Impact
As this vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, it has been actively exploited in the wild. Successful exploitation compromises the integrity of the organization's email communication channel, potentially leading to unauthorized access to sensitive corporate emails, lateral movement, and spear-phishing campaigns targeting other internal users.
Official Vendor Advisories & References
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
Frequently Asked SecOps Questions (CVE-2020-35730)
FAQQ1. How critical is CVE-2020-35730 and is it actively exploited in the wild?
CVE-2020-35730 is rated CVSS 6.1 (MEDIUM) with a 30-day EPSS exploitation probability of 32.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2020-35730?
Primary impacted vendors include roundcube across roundcubemail. Scope summary: Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10
Q3. What temporary mitigations or workarounds exist for CVE-2020-35730 before patching?
[Mitigation] Immediately upgrade Roundcube Webmail to version 1.2.13, 1.3.16, or 1.4.10 or higher Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2020-35730
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (roundcube)
View Category →Microsoft Exchange Server Cross-Site Scripting (XSS) and Spoofing Vulnerability Advisory (CVE-2026-42897)
[Affected Scope] All supported on-premises Microsoft Exchange Server environments.
CVE-2026-120114 Technical Vulnerability Analysis & Patch Advisory (CVSS 7.2)
[Affected Scope] Systems running unpatched versions impacted by CVE-2026-120114
WordPress WooCommerce PDF Invoices & Packing Slips Stored XSS Vulnerability (CVE-2026-107750) Security Advisory
[Affected Scope] WordPress WooCommerce PDF Invoices & Packing Slips plugin versions up to, and including, 5.16.4
WordPress SureCart Plugin Stored XSS Vulnerability (CVE-2026-107653) Security Advisory
[Affected Scope] All versions up to, and including, 4.9.4 of the SureCart WordPress plugin
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.