ZeroDay Findings
Sign inSign up

Findings

CVE-2024-42009

RoundCube Webmail Cross-Site Scripting Vulnerability

Published Aug 5, 2024 · updated Jun 17, 2026 · roundcube webmail

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 5, 2024 · Catalog

    Detected

    RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

  2. Jun 9, 2025 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  3. Jun 30, 2025 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

  4. Jun 17, 2026 · Catalog

    Updated

    RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

CISA due date Jun 30, 2025

Affected

  • cpe roundcube/webmailversion unspecified
  • vendor Roundcube Webmailversion unspecified

Sources

  • CISA KEVCVE-2024-42009

    RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

    cisa.gov
  • CVE.orgCVE-2024-42009

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2024-42009

    30-day exploitation probability 82.9%

    first.org
  • NIST NVDCVE-2024-42009

    A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

    nvd.nist.gov

References