CVE-2024-42009: Roundcube Webmail desanitization XSS in message_body()

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.3, CISA KEV listing with a near-term due date, and EPSS above the 99th percentile indicate active exploitation and severe impact.

What it is

Roundcube Webmail through 1.5.7 and 1.6.x through 1.6.7 contains a cross-site scripting flaw caused by a desanitization issue in message_body() in program/actions/mail/show.php. A crafted email message can execute script in the victim's webmail session, and the vendor has released 1.5.8 and 1.6.8 to fix it.

Impact

An attacker can run script in the victim's authenticated webmail session, allowing theft and sending of the victim's emails. The CVSS vector rates high confidentiality and integrity impact with scope change.

Attack surface

Reached remotely over the network by delivering a crafted email that the victim opens in Roundcube; no authentication is needed by the attacker, but the victim must interact with the message (UI:R).

Exploitation

CVE-2024-42009 is listed in CISA KEV with a 2025-06-30 remediation due date, and EPSS gives a 30-day probability of 0.82882 (99.654th percentile), indicating active exploitation. No ransomware campaign use is documented.

What to do

• Upgrade Roundcube to 1.5.8 or 1.6.8 (or later) per the vendor security update.
• If immediate patching is not possible, apply vendor-recommended mitigations or discontinue use of the affected webmail per CISA BOD 22-01 guidance.
• Restrict or monitor access to the Roundcube web interface until patched.
• Review mail filtering to block or quarantine messages matching known exploit patterns where feasible.

Detection

• Inspect web server and Roundcube logs for unusual requests to program/actions/mail/show.php or message body rendering endpoints.
• Hunt for anomalous outbound mail or session activity from webmail accounts consistent with stolen-email exfiltration.
• Monitor for unexpected script content or HTML in inbound email bodies reaching Roundcube.
• Alert on Roundcube versions below 1.5.8 or 1.6.8 in asset inventories.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.