CVE-2026-114718
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the me
Roundcube WebmailApplications & CMS
CVSS
4.7MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 14% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.
Text from CVE List
Affected versions 2
- Webmailaffected: 1.6.0 before 1.6.20CVE List
- Webmailaffected: 1.7.0 before 1.7.5CVE List
References 6
- github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.7.5Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20Fixvia CVE List
- github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7Fixvia CVE List
- bugs.debian.org/1151279Advisoryvia CVE List
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Advisoryvia CVE List