Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T13:16:54.423Z",
  "pubdate": "2026-08-17T13:16:54.423Z",
  "executiveSummary": "This vulnerability involves a stored Cross-Site Scripting (XSS) flaw affecting Roundcube Webmail before version 1.6.18 and version 1.7.x before 1.7.3. The security defect resides within the \"Add to address book\" action, where insufficient input sanitization or output encoding fails to neutralize malicious payloads embedded within input vectors processed by the address book subsystem.\nThe primary impact of this vulnerability is the execution of arbitrary JavaScript within the context of a victim's browser session. An authenticated remote attacker capable of crafting malicious input can leverage this flaw to hijack user sessions, access sensitive mailbox data, perform unauthorized actions on behalf of the user, or manipulate the webmail interface.\nThe risk implication is critical for collaborative or enterprise environments utilizing vulnerable Roundcube deployments, as exploitation compromises the confidentiality and integrity of user sessions. Attacker capabilities rely on inducing a user to interact with the malicious data vector, thereby triggering the stored payload execution. Exploitation prerequisites generally involve vector delivery via email or other input mechanisms that populate the vulnerable address book component, followed by user interaction with the affected UI action.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate sanitization and context-aware output encoding of user-supplied data processed during the \"Add to address book\" action within Roundcube Webmail. When specific input parameters containing markup or malicious JavaScript are passed to the address book component, the application fails to properly neutralize the payload before storing it or rendering it in the Document Object Model (DOM).\nThe vulnerable component is the address book management functionality responsible for parsing and displaying contact details derived from external sources or user inputs. Affected versions include Roundcube Webmail prior to 1.6.18 and versions in the 1.7.x branch prior to 1.7.3. Authentication requirements depend on the specific delivery vector, but payload execution typically occurs within an authenticated session when the user interacts with the compromised contact entry.\nThe attack flow proceeds in multiple sequential steps. First, an attacker crafts a malicious input payload—such as an email message with specially manipulated headers or body parameters designed to trigger the XSS when processed by the contact creation mechanism. Second, the victim initiates the \"Add to address book\" action utilizing the malicious data. Third, the application parses the input and stores the unsanitized payload within the address book database or state without enforcing strict validation.\nUpon subsequent retrieval and rendering of the contact information by the webmail interface, the stored payload is injected directly into the DOM. Because the browser interprets the payload as legitimate executable script rather than inert text data, the script executes within the security context of the victim's session. The payload behavior can range from session token exfiltration via DOM access to unauthorized API requests executed under the victim's privileges. Post-exploitation impact includes full account compromise, unauthorized message reading, and potential lateral propagation within the webmail environment depending on CSP configurations and session handling mechanisms."
}