CVE-2024-42009
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 9, 2025
- US federal agencies must remediate it by Jun 30, 2025 (BOD 22-01)
- First attack observed 303 days after disclosure
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Source: CISA KEV · Aug 7, 2026 Jul 23, 2026 Jul 7, 2026 May 14, 2026 May 12, 2026 Apr 8, 2026
CVSS score9.3 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:NWeakness type (CWE)CWE-79, CWE-79
Vendorsroundcube
Affected products
| Vendors | Product | Versions |
|---|---|---|
| roundcube | webmail | < 1.5.8 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.