Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-54433 →

DEBIAN-CVE-2026-54433

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The atta...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u10"}]}]

Debian:13 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17+dfsg-0+deb13u1"}]}]

Debian:14 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17+dfsg-1"}]}]

Références

advisory security-tracker.debian.org