CVE-2020-13965: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
Published Jun 9, 2020 · Updated Jun 17, 2026
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
References
- https://github.com/DrunkenShells/Disclosures/tree/master/CVE-2020-13965-Cross%20Site-Scripting%20via%20Malicious%20XML%20Attachment-Roundcube
- https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3
- https://github.com/roundcube/roundcubemail/compare/1.4.4...1.4.5
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.12
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.5
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DLESQ4LPJGMSWHQ4TBRTVQRDG7IXAZCW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ODPJXBHZ32QSP4MYT2OBCALYXSUJ47SK/
- https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12
- https://www.debian.org/security/2020/dsa-4700
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Roundcube vulnerabilities
All Roundcube entriesCVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability
medium6.1ExploitedDec 18, 2025CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
high8.8ExploitedJun 2, 2025CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
critical9.3ExploitedAug 5, 2024CVE-2024-37383
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedJun 7, 2024CVE-2023-5631
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium5.4ExploitedOct 18, 2023CVE-2023-43770
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedSep 22, 2023