CVE-2020-13965: Roundcube Webmail XSS via malicious XML attachment preview

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a very high EPSS score and public exploit references, though the CVSS base score is medium and exploitation requires user interaction.

What it is

Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5 allows cross-site scripting because text/xml is among the allowed types for attachment preview. A crafted XML attachment can execute script in the webmail origin when previewed, which matters because webmail sessions hold mail content and credentials.

Impact

An attacker can run script in the victim's Roundcube session, enabling theft of session data or mail content and actions performed as the logged-in user. The CVSS vector scores scope change with low confidentiality and integrity impact.

Attack surface

Reached remotely over the network by sending an email with a malicious XML attachment that the victim previews; no authentication is needed to deliver the message, but user interaction is required to trigger the preview.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-06-26, and EPSS gives a 30-day probability of 0.76596 (99.5th percentile); public exploit references are tagged Exploit.

What to do

• Upgrade Roundcube Webmail to 1.3.12 or 1.4.5 or later; apply the vendor patch commit.
• Apply distribution updates for Debian and Fedora packages carrying Roundcube.
• If patching is not possible, disable or restrict attachment preview for text/xml and similar active content types.
• Follow CISA KEV required action: apply vendor mitigations or discontinue use of the product if mitigations are unavailable.

Detection

• Search mail gateway and webmail logs for XML attachments (text/xml, application/xml) delivered to Roundcube users.
• Monitor for unexpected script execution or anomalous requests originating from the webmail origin in browser or proxy telemetry.
• Review Roundcube version inventory to identify hosts below 1.3.12 or 1.4.5.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.