CVE-2026-114718 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified affects versions of Roundcube Webmail prior to 1.6.20 and version series 1.7.x prior to 1.7.5, specifically within the functionality provided by the password plugin. This component is responsible for allowing users to change their email passwords through various backend drivers, such as those interfacing with DirectAdmin or other mail server APIs. The core technical flaw lies in how error messages generated by these external password drivers are processed and rendered back to the end user. When a driver encounters an issue during the password update process, it returns an error text string that is subsequently concatenated directly into the HTML response presented to the browser without any form of sanitization or encoding. This lack of output encoding creates a classic cross-site scripting vector where malicious content can be injected if the backend service provides untrusted data as part of its error reporting mechanism.
From a technical perspective, this issue represents an instance of stored or reflected cross-site scripting depending on how the driver communicates errors, but it is fundamentally categorized under CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting XSS. The vulnerability arises because the application trusts the content returned by the password driver without validating its structure or escaping special HTML characters such as angle brackets and quotes. If an attacker can influence the backend service, for example through a compromised DirectAdmin API endpoint or via server-side manipulation of the response payload, they can inject arbitrary JavaScript code into the page context. This allows the execution of scripts in the browser session of any user who views the error message, effectively bypassing same-origin policy restrictions and gaining access to sensitive client-side data.
The operational impact of this vulnerability is significant for organizations relying on Roundcube Webmail for email management. Successful exploitation enables an attacker to perform actions such as stealing session cookies, which could lead account takeover if combined with other techniques like cross-site request forgery or network interception. It also allows for keylogging within the webmail interface, potentially capturing sensitive information including passwords and personal communications. Furthermore, attackers can redirect users to malicious phishing sites by manipulating DOM elements on the page. This compromises the confidentiality and integrity of user data while undermining trust in the email infrastructure. The attack requires no special privileges other than the ability to trigger a password change operation that results in an error containing injected payloads, making it relatively straightforward for adversaries with access to backend systems or those who can manipulate API responses.
Mitigation strategies primarily involve upgrading Roundcube Webmail to version 1.6.20 or later if using the stable branch, or version 1.7.5 and above for the development series. The upstream fix addresses this issue by implementing proper output encoding on all driver error messages before they are rendered in the user interface, ensuring that any special characters are escaped into their corresponding HTML entities. This prevents the browser from interpreting injected strings as executable code. In environments where immediate patching is not feasible, administrators should consider restricting access to password change functionalities or monitoring backend API responses for anomalous content. Additionally, implementing a strict Content Security Policy can help mitigate the impact by preventing unauthorized script execution even if an injection occurs. This vulnerability aligns with ATT&CK technique T1059 Command and Scripting Interpreter as it involves executing arbitrary code within the victim's browser environment through web application vulnerabilities.