ZeroDay Findings
Sign inSign up

Findings

CVE-2020-35730

Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability

Published Dec 28, 2020 · updated Jun 16, 2026 · roundcube webmail

An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Timeline

Detection, updates, and resolution for this record.

  1. Dec 28, 2020 · Catalog

    Detected

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

  2. Jun 22, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 13, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

Required action

Apply updates per vendor instructions.

CISA due date Jul 13, 2023

Affected

  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe roundcube/webmailversion unspecified
  • vendor Roundcube Roundcube Webmailversion unspecified

Sources

  • CISA KEVCVE-2020-35730

    Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.

    cisa.gov
  • CVE.orgCVE-2020-35730

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-35730

    30-day exploitation probability 32.9%

    first.org
  • NIST NVDCVE-2020-35730

    An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.

    nvd.nist.gov

References