Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 525
Alerts This Week
Warning Icon 1 525

Debian DLA-4693-1 Roundcube High Cross-Site Scripting Denial of Service

debian lts
Calendar Grey July 21, 2026
Scroller Debian Lts
Multiple vulnerabilities in Roundcube threaten user security, allowing risks like XSS and account takeover. Update immediately.
Multiple vulnerabilities were discovered in Roundcube, a skinnable AJAX based webmail solution for IMAP servers, which could result in cross-site scripting, server-side request for...
Topics%20covered

Topics Covered

security advisory denial of service cross site scripting information disclosure account takeover deblts

Summary

CVE-2026-54432

Bohdan Kurinnoy discovered that attachment MIME types were neither
sanitized nor escaped on the attachment-validation warning page,
yielding a stored XSS vulnerability.

CVE-2026-54433

Bohdan Kurinnoy discovered that plain-text rendering was subject to
a zero-click stored XSS vulnerability via crafted mailto: URIs.

CVE-2026-62641

It was discovered that the TNEF decoder was subject to Denial of
Service via crafted compressed-RTF size in the winmail.dat
attachment file.

CVE-2026-62642

An infinite loop was discovered in the TNEF decoder, which may lead
to denial of service upon opening an email with a TNEF attachment.

CVE-2026-62643

It was discovered that the CSS sanitization fixes for CVE-2026-35540 and
CVE-2026-48843 were insufficient, allowing a malicious embedded
stylesheet in an HTML email to lead to SSRF or information
disclosure.

CVE-2026-62644

It was discovered that the password plugin was subject to username

Read the Full Advisory


Severity
important
Lowest
Low
Medium
High
Critical

Package: roundcube
Version: 1.4.15+dfsg.1-1+deb11u10 1.6.5+dfsg-1+deb12u10
CVE ID: CVE-2026-54432 CVE-2026-54433 CVE-2026-62641 CVE-2026-62642
Debian Bug: 1138086 1141495

Topics%20covered

Topics Covered

security advisory denial of service cross site scripting information disclosure account takeover deblts

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.