CVE-2023-43770: Roundcube Webmail XSS via crafted links in plain-text emails

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is in CISA KEV with a high EPSS score and remote, unauthenticated delivery, though exploitation requires the victim to view the email.

What it is

Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 is vulnerable to cross-site scripting because of how rcube_string_replacer.php handles crafted links in text/plain email messages. An attacker can deliver a malicious email that executes script in the victim's webmail session, and the flaw is listed in CISA KEV, indicating real-world exploitation.

Impact

An attacker can run script in the context of the victim's Roundcube session, potentially reading mail, stealing session data, or performing actions as the user. The CVSS scope change (S:C) means impact can extend beyond the vulnerable component.

Attack surface

Reached remotely over the network by sending a crafted text/plain email that the victim views in Roundcube; no authentication is required to send the message, but user interaction (opening or viewing the email) is required per the CVSS vector.

Exploitation

CISA added it to KEV on 2024-02-12 with a remediation due date of 2024-03-04, and EPSS shows a 30-day probability of 0.58483 (99th percentile), indicating active exploitation is likely. No ransomware campaign use is documented.

What to do

• Upgrade Roundcube to 1.4.14, 1.5.4, 1.6.3 or later; apply the vendor patch commit e92ec206a886461245e1672d8530cc93c618a49b.
• For Debian deployments, apply the fixes referenced in the Debian LTS announcement.
• If immediate patching is not possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the product.
• Restrict or monitor access to the webmail interface and enforce strong session protections until patched.

Detection

• Inspect Roundcube or web server logs for requests containing suspicious script payloads in message-rendering paths.
• Monitor for anomalous outbound requests or session activity originating from webmail users after viewing email.
• Review email gateway logs for text/plain messages with crafted links targeting Roundcube users.
• Check for unexpected changes to Roundcube files or configuration that could indicate post-exploitation.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.