{"id":"CVE-2026-54432","published":"2026-07-14T16:21:55Z","modified":"2026-07-15T15:13:14Z","title":"Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS)","vendor":"Roundcube","product":"Webmail","tier":"tail","description":{"text":"Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.","provenance":"source","from":"CVE.org"},"cvss":{"score":4.7,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00206,"percentile":0.10662,"provenance":"source"},"cwes":[{"id":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation"}],"references":[{"url":"https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2","tags":[]}],"priority":{"score":5.4,"factors":[{"name":"EPSS percentile","points":2.13},{"name":"CVSS severity","points":3.29}]},"vendorSlug":"roundcube","affectedVersions":[{"vendor":"Roundcube","product":"Webmail","versions":[">= 1.6.0, < 1.6.17",">= 1.7.0, < 1.7.2"]}],"euvd":{"id":"EUVD-2026-43733","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-class-roundcube-webmail-cwe-79"}}