CVE-2026-54432

Name of the Vulnerable Software and Affected Versions RoundCube versions prior to 1.7

Description A stored cross-site scripting (XSS) flaw exists where an unescaped attachment MIME type is displayed on the attachment-validation warning page. An attacker can craft a malicious MIME type string that, when rendered without proper sanitization, executes arbitrary JavaScript in the victim's session. This issue requires zero user interaction to exploit, as the script executes the moment the email is viewed.

Recommendations Update to version 1.7.