CVE-2020-35730: Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkrefaddindex in rcubestringreplacer.php.
Published Dec 28, 2020 · Updated Jun 17, 2026
Required action
Apply updates per vendor instructions.
Advisory details
From the National Vulnerability Database. This product uses the NVD API but is not endorsed or certified by the NVD.
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
References
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=978491
- https://github.com/roundcube/roundcubemail/compare/1.4.9...1.4.10
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.13
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.16
- https://github.com/roundcube/roundcubemail/releases/tag/1.4.10
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCEU4BM5WGIDJWP6Z4PCH62ZMH57QYM2/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HMLIZWKMTRCLU7KZLEQHELS4INXJ7X5Q/
- https://roundcube.net/download/
- https://www.alexbirnberg.com/roundcube-xss.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-35730
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology
More Roundcube vulnerabilities
All Roundcube entriesCVE-2025-68461
RoundCube Webmail Cross-site Scripting Vulnerability
medium6.1ExploitedDec 18, 2025CVE-2025-49113
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
high8.8ExploitedJun 2, 2025CVE-2024-42009
RoundCube Webmail Cross-Site Scripting Vulnerability
critical9.3ExploitedAug 5, 2024CVE-2024-37383
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedJun 7, 2024CVE-2023-5631
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium5.4ExploitedOct 18, 2023CVE-2023-43770
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
medium6.1ExploitedSep 22, 2023