CVE-2023-5631: Roundcube Webmail stored cross-site scripting, exploited as a zero-day by an APT
The short version: Roundcube Webmail has a stored cross-site scripting flaw (CVE-2023-5631) that hides attacker JavaScript in a crafted SVG inside an HTML email. It was used as a zero-day for espionage against European government mail before the fix, and it's in CISA's KEV catalog. The remedy is a simple upgrade. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — see below |
| CVSS v3.1 (NVD) | 5.4 — Medium · AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| CVSS (ESET, CNA) | 6.1 — Medium · AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| EPSS | 75.87% · 99.47th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2023-11-16 |
| Known exploited? | Yes — exploited as a zero-day for espionage before the fix |
| Vulnerability type | CWE-79 stored cross-site scripting (crafted SVG in HTML email) → arbitrary JavaScript in session |
| Requires authenticated session? | No for the attacker — a logged-in victim must open the crafted message (UI:R) |
| Affected | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 |
| Fixed in | 1.4.15 · 1.5.5 · 1.6.4 |
What you need to know
The bug is in rcube_washtml.php, Roundcube's HTML sanitizer: a crafted SVG document slips malicious markup past the cleaner, so viewing the email loads arbitrary JavaScript in the user's session.
- It was a nation-state zero-day. Security researchers documented use of this flaw against government mail servers before a patch existed — the theoretical was operational.
- Delivery is email, storage makes it worse. Because it's stored XSS, the payload sits in the mailbox and fires on view.
- The payoff is the session. Script in webmail can read what the user sees and stage credential capture.
How serious we see it
Critical — with a clear-eyed note about how it was used.
NVD scores 5.4 and the CNA 6.1; either way this is user-interaction XSS with limited direct impact, not code execution. What raises the stakes is history: it was an espionage zero-day, and webmail XSS reliably becomes credential theft. We keep the rating at Moderate because the mechanical impact is bounded to the session — and because the fix is published and quick to confirm. Patch it and it's closed.
Recommendations
Straight from Roundcube's advisory and CISA:
- Patch now. Upgrade to 1.6.4, 1.5.5, or 1.4.15 (or later).
- Enforce MFA on webmail to blunt credential theft.
- Restrict exposure. Keep the Roundcube host reachable only where it must be.
- Hunt if you ran an affected build exposed, especially if you're a plausible espionage target — review for anomalous access and forwarding rules.
- Confirm your exposure first. Verify whether an internet-facing Roundcube instance exists and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Roundcube from little more than your domain, fingerprints the version, and flags exposure tied to KEV-listed vulnerabilities like this one, ranked up because it's actively exploited. We identify and flag the affected version; we don't deliver the payload. The outside-in view means an exposed, unpatched Roundcube is already on your map — the kind of asset espionage crews go looking for.