Live › vulnerability › CVE-2020-35730
Go to dashboardRoundcube Webmail, a web-based email client, has a cross-site scripting flaw: a plain text email containing JavaScript in a link reference is mishandled, so the script runs in the victim's browser. An attacker who gets a user to open such a message can run script in their Roundcube session and read or act on their mail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Roundcube Roundcube Webmail | vendor | – | – |
| roundcube webmail | vendor | < 1.2.13 | 1.2.13 |
| roundcube webmail | vendor | >= 1.3.0, < 1.3.16 | 1.3.16 |
| roundcube webmail | vendor | >= 1.4, < 1.4.10 | 1.4.10 |
| fedoraproject fedora | vendor | = 32 | – |
| fedoraproject fedora | vendor | = 33 | – |
| debian linux | vendor | = 9.0 | – |
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-35730")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.