CVE-2026-114718CWE-79cross-site-scripting

CVE-2026-114718

Medium · published October 22, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
14.3
In the wild
Unconfirmed
What it is

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00241 · 14.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-10-22T06:16Z
References (6)
https://bugs.debian.org/1151279 · [email protected]https://github.com/roundcube/roundcubemail/commit/16bbca70b668e85332f23333946a764865bead94 · [email protected]https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 · [email protected]https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 · [email protected]https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 · [email protected]
EPSS history
Timeline
  • 23 OCT 03:55Z
    EPSS moved — → 0%
    epss
  • 22 OCT 01:24Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
    cvelistv5
  • 22 OCT 01:24Z
    Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin
    cvelistv5