5.4

CVE-2026-74999

Medienbericht
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Roundcube ≫ Webmail Version >= 1.6.0 < 1.6.18
Roundcube ≫ Webmail Version >= 1.7.0 < 1.7.3
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.22% 0.121
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
MITRE 5.4 2.3 2.7
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Für Zugriff zu Vulnerability Intelligence ist ein VulnDex Zugang erforderlich.
VulnDex Intel
Media Report
18.08.2026 09:32
https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
Vendor Advisory
https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
Release Notes
https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
Release Notes
https://github.com/roundcube/roundcubemail/commit/32f20c6bfd12dff9cfb6880ae303e740f0804fe8
Patch
https://github.com/roundcube/roundcubemail/commit/2d2a9604a820ee279c9ffcfe856b9b93a93995a8
Patch