CVE-2023-5631: Roundcube Webmail stored XSS via crafted SVG in HTML email

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is a stored XSS in a widely deployed webmail product that CISA lists as known exploited with a very high EPSS score, even though the CVSS base score is only 5.4.

What it is

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 mishandle sanitization in program/lib/Roundcube/rcube_washtml.php, allowing a stored cross-site scripting payload delivered through an HTML email containing a crafted SVG document. Because the payload is stored in the mailbox, it can execute in the victim's webmail session whenever the message is rendered.

Impact

An attacker can run arbitrary JavaScript in the context of the victim's Roundcube session, enabling session or credential theft and actions performed as the victim. The CVSS vector scopes the impact to low confidentiality and integrity with no availability effect.

Attack surface

Reached remotely over the network by sending an HTML email with a crafted SVG to a Roundcube user; the vector requires low privileges (PR:L) and user interaction (UI:R), meaning the victim must open or view the message for the script to run.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2023-10-26 with a 2023-11-16 remediation due date, and EPSS gives a 30-day probability of 0.75873 (99.5th percentile); a reference is tagged Exploit, though no ransomware campaign use is documented.

What to do

• Upgrade Roundcube to 1.4.15, 1.5.5, or 1.6.4 (or later) as applicable to your branch.
• Apply the vendor patches referenced in the Roundcube commits and Debian/Fedora advisories if immediate upgrade is not possible.
• If patching is delayed, follow CISA's required action to apply vendor mitigations or discontinue use of the product.
• Restrict or disable rendering of remote HTML content and SVG in webmail where policy allows.

Detection

• Search mail logs and message stores for HTML emails containing SVG content, especially embedded script or event handlers.
• Monitor webmail access logs for anomalous JavaScript-driven requests or session activity following message viewing.
• Hunt for known exploit indicators from the referenced GitHub issue and public advisories in inbound mail and webmail telemetry.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.