CVE-2018-19206
Mediumsteps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
Published Nov 12, 2018 · Updated Sep 17, 2026 · Also known as DEBIAN-CVE-2018-19206, DSA-4344-1, UBUNTU-CVE-2018-19206
Key Facts
Patch immediately- CVE-2018-19206 is a medium-severity vulnerability (CVSS 6.1 v3.1) affecting Webmail (Roundcube), Debian Linux, roundcubemail (alpine) and 6 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 56% probability of exploitation in the next 30 days.
- Fixed versions are available, including roundcube 1.2.3+dfsg.1-4+deb9u3, roundcube 1.2~beta+dfsg.1-0ubuntu1+esm7, roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS (30-day exploit likelihood)
56%
Higher than 99.0% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2018-19206 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
Affected Products
30 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| WebmailRoundcube | See advisory | 1.3.8 |
| Debian LinuxDebian | 9.0 | n/a |
| roundcubemailalpine | See advisory | 1.3.8-r0 |
| roundcubedebian | See advisory | 1.3.8+dfsg.1-1 |
| roundcube-coreubuntu | See advisory | 1.3.6+dfsg.1-1ubuntu0.1~esm7 |
Patched Releases
roundcube
1.2.3+dfsg.1-4+deb9u3, 1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7, 1.3.8+dfsg.1-1
Webmail
1.3.8
roundcube-core
1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7
roundcube-mysql
1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7
roundcube-pgsql
1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7
roundcube-plugins
1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7
roundcube-sqlite3
1.2~beta+dfsg.1-0ubuntu1+esm7, 1.3.6+dfsg.1-1ubuntu0.1~esm7
roundcubemail
1.3.8-r0
Timeline
Publicly disclosed
Nov 12, 2018
Last updated
Sep 17, 2026
Weakness Type
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
References
- advisoryhttps://github.com/roundcube/roundcubemail/commit/102fbf1169116fef32a940b9fb1738bc45276059
- advisoryhttps://github.com/roundcube/roundcubemail/commit/adcac3b9de2728c34c4d2b107e54823b6a7f6a5b
- advisoryhttps://github.com/roundcube/roundcubemail/issues/6410
- advisoryhttps://roundcube.net/news/2018/10/26/update-1.3.8-released
- advisoryhttps://security-tracker.debian.org/tracker/CVE-2018-19206
FAQ
Common Questions.
steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of , as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
Affected: Webmail (Roundcube); Debian Linux versions 9.0; roundcubemail (alpine), among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including roundcube 1.2.3+dfsg.1-4+deb9u3, roundcube 1.2~beta+dfsg.1-0ubuntu1+esm7, roundcube 1.3.6+dfsg.1-1ubuntu0.1~esm7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2018-19206 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo