Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-114718

Roundcube Webmail: cross-site scripting

Risk score
41/100
CVSS
6.1 v3.1
Exploit chance (30 days)
0.3%
Published
22 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin AP…
Affected
Roundcube Webmail before 1.6.20, 1.7, 1.7.5
Fix
Upgrade Roundcube Webmail to 1.6.20, 1.7 or 1.7.5 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Roundcube WebmailTHE FLAWSTHE FIXCVE-2026-114718Cross-site scriptingCVSS 6.1 · EPSS 0%CVE-2026-114724Unsafe deserialisationCVSS 8.1 · EPSS 0%CVE-2026-114716Roundcube Webmail before1.6.20 and 1.7.x before 1.7.5 isaffected by a mail header…CVSS 8.5 · EPSS 0%CVE-2026-114727Roundcube Webmail before1.6.20 and 1.7.x before 1.7.5passes potentially unsafe…CVSS 8.3 · EPSS 0%Upgrade Roundcube Webmail1.6.20 · 1.7 · 1.7.5or later on your release lineWho is exposedRoundcube Webmail before1.6.20, 1.7, 1.7.5AMBER · PATCH THIS WEEKRoundcubeWebmailRoundcube Webmail before 1.6.20and 1.7.x before 1.7.5 contains anobject injection primitive inrcube_session::unserialize(). Asession key prefixed with “!”was treated as having no value,and the reconstructed…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)399 other warnings in 30 days →Same productEarlier Roundcube Webmail warnings8 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Roundcube Webmail: Amber, patch this week. Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the …

The flaws

  • CVE-2026-114718: Cross-site scripting (CVSS 6.1 · EPSS 0%)
  • CVE-2026-114724: Unsafe deserialisation (CVSS 8.1 · EPSS 0%)
  • CVE-2026-114716: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection… (CVSS 8.5 · EPSS 0%)
  • CVE-2026-114727: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into… (CVSS 8.3 · EPSS 0%)

The fix

Upgrade Roundcube Webmail: 1.6.20 · 1.7 · 1.7.5 or later on your release line

Who is exposed: Roundcube Webmail before 1.6.20, 1.7, 1.7.5

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 6.1 medium

References

Original description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.

Last activity 22 Oct 2026. Patch Forecast updates every hour.