USN-8097-2: roundcube Ubuntu
CVSS: UnknownPublished
Published 18-03-2026Last modified 19-03-2026
Vulnerability summary
USN-8097-2 is a vulnerability in roundcube Ubuntu with no CVSS score yet.
CVSS score
Not scored
010
No CVSS score recordedEPSS score
Not scored
0%100%
No EPSS score yetKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Timeline
- 18-03-2026PublishedVulnerability first disclosed.
- 19-03-2026Last modifiedVulnerability information updated.
Description
roundcube regression USN-8097-1 fixed a vulnerability in roundcube. The update caused a regression affecting the HTML sanitizer, preventing Roundcube from rendering any email message body. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that Roundcube Webmail did not properly sanitize the animate tag within SVG documents. An attacker could possibly use this issue to cause a cross-site scripting attack.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- roundcube< 1.4.3+dfsg.1-1ubuntu0.1~esm7
1 vendor · 1 product
References
2 linksRelated vulnerabilities
USN-8223-1ubunturoundcuberoundcube vulnerabilities
It was discovered that Roundcube Webmail mishandled Punycode xn-- domain names.
An attacker could possibly use this issue to cause a homograph attack. (CVE-2019-15237)
It was discovered that Roundcube Webmail did not properly sanitize certain
attributes when handling CSS within HTML messages and certain SVG attributes.
An attacker could possibly use this issue to cause a cross-site scripting attack.
(CVE-2024-38356, CVE-2024-38357)
It was discovered that Roundcube Webmail did not properly sanitize certain HTML
attributes when rendering e-mail messages. An attacker could possibly use this
issue to cause a cross-site scripting attack. (CVE-2024-42008)
It was discovered that Roundcube Webmail did not properly filter certain CSS token
sequences within rendered e-mail messages. An attacker could possibly use this
issue to obtain sensitive information. (CVE-2024-42010)
It was discovered that Roundcube Webmail did not properly treat an SVG
tag as an image source within its HTML sanitizer. An attacker could possibly use
this issue to bypass remote image blocking to track email open actions or
potentially bypass access control. (CVE-2026-25916)
It was discovered that Roundcube Webmail did not properly handle comments within
Cascading Style Sheets (CSS). An attacker could possibly use this issue to perform
a CSS injection attack. (CVE-2026-26079)USN-8132-1ubunturoundcuberoundcube vulnerabilities
It was discovered that Roundcube Webmail did not properly sanitize
certain HTML elements within the e-mail body. An attacker could possibly
use this issue to cause a cross-site scripting attack. This issue was only
addressed in Ubuntu 16.04 LTS. (CVE-2016-4068, CVE-2016-4069)
It was discovered that Roundcube Webmail did not properly handle certain
configuration parameters. An attacker could possibly use this issue to
execute arbitrary code. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2016-9920)
It was discovered that Roundcube Webmail did not properly sanitize CSS styles
within SVG documents. An attacker could possibly use this issue to cause
a cross-site scripting attack. This issue was only addressed in Ubuntu 16.04 LTS.
(CVE-2017-6820)
It was discovered that Roundcube Webmail did not properly restrict exec call in
certain drivers of the password plugin. An authenticated user could possibly
use this issue to perform arbitrary password resets. This issue was only addressed in
Ubuntu 16.04 LTS. (CVE-2017-8114)
It was discovered that Roundcube Webmail did not properly set file permissions within
the Enigma plugin. An attacker could possibly use this issue to exfiltrate GPG private
keys via network connectivity. (CVE-2018-1000071)
It was discovered that Roundcube Webmail did not properly handle GnuPG MDC
integrity-protection warnings. An attacker could possibly use this issue to obtain
sensitive information from encrypted communications. (CVE-2018-19205)
It was discovered that Roundcube Webmail did not properly sanitize <svg> and <style>
tags within HTML attachments. An attacker could possibly use this issue to cause a
cross-site scripting attack. (CVE-2018-19206)
It was discovered that Roundcube Webmail did not properly handle partially encrypted
multipart messages. An attacker could possibly use this issue to cause
leaking of the plaintext of encrypted messages via an email reply. (CVE-2019-10740)
It was discovered that Roundcube Webmail did not properly sanitize a certain parameter
within the archive plugin. An attacker could possibly use this issue to perform an
IMAP injection attack. This issue was only addressed in Ubuntu 16.04 LTS. (CVE-2018-9846)USN-6848-1ubunturoundcuberoundcube vulnerabilities
Matthieu Faou and Denys Klymenko discovered that Roundcube incorrectly
handled certain SVG images. A remote attacker could possibly use this
issue to load arbitrary JavaScript code. This issue only affected Ubuntu
18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10.
(CVE-2023-5631)
Rene Rehme discovered that Roundcube incorrectly handled certain headers.
A remote attacker could possibly use this issue to load arbitrary
JavaScript code. This issue only affected Ubuntu 20.04 LTS,
Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2023-47272)
Valentin T. and Lutz Wolf discovered that Roundcube incorrectly handled
certain SVG images. A remote attacker could possibly use this issue to
load arbitrary JavaScript code. This issue only affected Ubuntu 18.04 LTS,
Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 23.10. (CVE-2024-37383)
Huy Nguyễn Phạm Nhật discovered that Roundcube incorrectly handled
certain fields in user preferences. A remote attacker could possibly use
this issue to load arbitrary JavaScript code. (CVE-2024-37384)USN-5182-1ubunturoundcuberoundcube vulnerabilities
It was discovered that Roundcube Webmail allowed JavaScript code to be present
in the CDATA of an HTML message. A remote attacker could possibly use this
issue to execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-12625)
It was discovered that Roundcube Webmail incorrectly processed login and
logout POST requests. An attacker could possibly use this issue to launch a
cross-site request forgery (CSRF) attack and force an authenticated user to be
logged out. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2020-12626)
It was discovered that Roundcube Webmail incorrectly processed new plugin names
in rcube_plugin_api.php. An attacker could possibly use this issue to obtain
sensitive information from local files or to execute arbitrary code.
This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and
Ubuntu 20.04 ESM. (CVE-2020-12640)
It was discovered that Roundcube Webmail did not sanitize shell metacharacters
recovered from variables in its configuration settings. An attacker could
possibly use this issue to execute arbitrary code in the server. This issue
only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM.
(CVE-2020-12641)
It was discovered that Roundcube Webmail incorrectly sanitized characters in
the username template object. An attacker could possibly use this issue to
execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-13964)
It was discovered that Roundcube Webmail allowed preview of text/html content.
A remote attacker could possibly use this issue to send a malicious XML
attachment via an email message and execute a cross-site scripting (XSS)
attack. This issue only affected Ubuntu 16.04 ESM, Ubuntu 18.04 ESM
and Ubuntu 20.04 ESM. (CVE-2020-13965)
Andrea Cardaci discovered that Roundcube Webmail did not properly sanitize
HTML special characters when dealing with HTML messages that contained an SVG
element in the XML namespace. A remote attacker could possibly use this issue
to execute a cross-site scripting (XSS) attack. This issue only affected
Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-15562)
Lukasz Pilorz discovered that Roundcube Webmail did not properly sanitize HTML
special characters when dealing with HTML messages that contained SVG
documents. A remote attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM
and Ubuntu 20.04 ESM. (CVE-2020-16145)
Alex Birnberg discovered that Roundcube Webmail incorrectly sanitized
characters in plain text e-mail messages that included link reference
elements. A remote attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM,
Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2020-35730)
It was discovered that Roundcube Webmail did not properly sanitize HTML
special characters in warning messages that contained an attachment's filename
extension. A remote attacker could possibly use this issue to execute a
cross-site scripting (XSS) attack. This issue only affected Ubuntu 16.04 ESM,
Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44025)
It was discovered that Roundcube Webmail incorrectly managed session variables
related to search functionalities. A remote attacker could possibly use this
issue to execute a SQL injection attack. This issue only affected
Ubuntu 16.04 ESM, Ubuntu 18.04 ESM and Ubuntu 20.04 ESM. (CVE-2021-44026)
It was discovered that Roundcube Webmail did not properly sanitize HTML
special characters when dealing with HTML messages that contained CSS content.
A remote attacker could possibly use this issue to execute a cross-site
scripting (XSS) attack. This issue only affected Ubuntu 18.04 ESM,
Ubuntu 20.04 ESM and Ubuntu 22.04 ESM. (CVE-2021-46144)CVE-2018-1000071debianroundcube+21.68%roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity.CVE-2018-19205debianroundcube+21.63%Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php.