CVE-2024-37383: Roundcube Webmail XSS via SVG animate attributes

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is in CISA KEV with very high EPSS, but requires user interaction and yields limited confidentiality and integrity impact per CVSS.

What it is

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 is vulnerable to cross-site scripting through SVG animate attributes. Because the flaw sits in the webmail client, a crafted message can run script in the context of the victim's session, which matters for a widely deployed mail interface.

Impact

An attacker can execute script in a victim's webmail session, enabling theft of session data or mailbox content and actions performed as the victim. The CVSS vector shows low confidentiality and integrity impact with scope change, so the effect extends beyond the vulnerable component.

Attack surface

Reached over the network with no authentication required, but exploitation needs user interaction, consistent with the CVSS vector AV:N/AC:L/PR:N/UI:R. The likely delivery path is a crafted email or page rendered by the webmail client.

Exploitation

CVE-2024-37383 is listed in CISA KEV with a due date of 2024-11-14, and EPSS gives a 30-day probability of 0.73296 (99.4th percentile), indicating observed exploitation and high likelihood. No ransomware campaign use is documented.

What to do

• Upgrade Roundcube to 1.5.7 or 1.6.7 (or later) using the vendor patch commit and release notes.
• For Debian deployments, apply the Debian LTS advisory updates for the roundcube package.
• If immediate patching is not possible, follow CISA KEV required action: apply vendor mitigations or discontinue use of the product.
• Restrict or disable rendering of untrusted HTML/SVG content in webmail where configuration allows.
• Review mail filtering to block messages carrying SVG animate payloads.

Detection

• Search webmail and proxy logs for requests containing SVG animate attributes or script-like parameters in message rendering paths.
• Monitor for anomalous authenticated webmail sessions, including unexpected outbound requests or session token reuse.
• Alert on Roundcube versions below 1.5.7 or 1.6.7 identified in asset inventories.
• Correlate email gateway logs with webmail access logs for messages that trigger client-side script execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.