CVE-2026-74998

Katalog CVE

CVSS 7.2 · High EPSS 0,44%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada roundcube webmail. Skor CVSS 3.1 7.2 (High) menurut mitre.org.

Deskripsi (NVD)

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site scripting) via MIME sniffing.

Rincian

Terbit di NVD

17 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Analyzed

CVSS 3.1

7.2 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 advisory vendor
• https://github.com/roundcube/roundcubemail/commit/62d33c8a0dc3fd0dd03984220dc9709e8e0de43b patch
• https://github.com/roundcube/roundcubemail/commit/a2334990c02f7cb77b1a8d6fa97fcd9e1b5cd1fb patch
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 release notes
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 release notes