CVE-2026-114718: XSS
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to influence error text returned by the configured password driver, and a user must interact with the resulting message in the Roundcube interface. A backend such as the DirectAdmin API is identified as an example of a component that could supply such attacker-controlled text.
Which deployments should be prioritized for remediation?
Prioritize Roundcube deployments that use the password plugin with a driver or backend capable of returning attacker-influenced error messages. The affected releases are versions before 1.6.20 and 1.7.x releases before 1.7.5.
What does the available fix change?
The fix HTML-escapes password-driver error messages before displaying them to users, preventing error text from being interpreted as script in the Roundcube interface.