All errata/sisyphus/ALT-PU-2026-10778-2
ALT-PU-2026-10778-2

Package update roundcube in branch sisyphus

Version1.7.2-alt1
Task#424769
Published2026-07-10
Max severityCRITICAL
Severity:

Closed issues (2)

CVE-2026-54432
MEDIUM4.7

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.

Published: 2026-07-14Modified: 2026-07-15
CVSS 3.xMEDIUM 4.7
CVSS:3.x/CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
References
CVE-2026-54433
CRITICAL10.0

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

Published: 2026-07-14Modified: 2026-07-17
CVSS 3.xCRITICAL 10.0
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
References