CVE-2023-5631 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Affected Products**: Roundcube Webmail. 📉 **Vulnerable Versions**: • 1.4.x **before** 1.4.15 • 1.5.x **before** 1.5.5 • 1.6.x **before** 1.6.4

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploitation**: YES. 📂 **POCs Available**: Multiple public PoCs exist on GitHub (e.g., `greandfather`, `soreta2`). They demonstrate saving XSS via crafted SVG documents in HTML emails.

Q: How to self-check? (Features/Scanning)

🔍 **Self-Check**: 1. Check Roundcube version in admin panel. 2. Scan for `rcube_washtml.php` handling of SVG tags. 3. Test with a crafted SVG email payload (use PoCs cautiously in isolated envs).

Q: Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: YES. 🛠️ **Patches**: Official updates released on 2023-10-16. 📌 **Safe Versions**: Upgrade to 1.4.15, 1.5.5, or 1.6.4+.

Q: What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. Disable HTML email rendering if possible. 2. Implement strict WAF rules to block SVG/script injection in email inputs. 3. Educate users not to open suspicious HTML emails.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: HIGH. 📅 **Priority**: Patch immediately. Since PoCs are public and exploitation is straightforward (view email), unpatched instances are actively at risk of account compromise.

Updated May 06, 2026 CVSS 6.1 · Medium

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: A Stored Cross-Site Scripting (XSS) flaw in Roundcube Webmail. <br>💥 **Consequences**: Attackers inject malicious JavaScript via crafted HTML emails (specifically SVG).…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: Flaw in `program/lib/Roundcube/rcube_washtml.php`. <br>🔍 **CWE**: CWE-79 (Improper Neutralization of Input During Web Page Generation).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Affected Products**: Roundcube Webmail. <br>📉 **Vulnerable Versions**: <br>• 1.4.x **before** 1.4.15 <br>• 1.5.x **before** 1.5.5 <br>• 1.6.x **before** 1.6.4

Q4What can hackers do? (Privileges/Data)

💻 **Attacker Actions**: Execute arbitrary JavaScript code in the victim's browser context. <br>📂 **Impact**: Steal cookies/session tokens, hijack accounts, or redirect users to phishing sites.…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚠️ **Threshold**: Medium. <br>🔑 **Auth**: Requires User Interaction (UI:R). The victim must open/view the malicious email. <br>🌐 **Access**: Network Accessible (AV:N).…

Read full answer (login)

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Exploitation**: YES. <br>📂 **POCs Available**: Multiple public PoCs exist on GitHub (e.g., `greandfather`, `soreta2`). They demonstrate saving XSS via crafted SVG documents in HTML emails.

Q7How to self-check? (Features/Scanning)

🔍 **Self-Check**: <br>1. Check Roundcube version in admin panel. <br>2. Scan for `rcube_washtml.php` handling of SVG tags. <br>3. Test with a crafted SVG email payload (use PoCs cautiously in isolated envs).

Q8Is it fixed officially? (Patch/Mitigation)

✅ **Fixed**: YES. <br>🛠️ **Patches**: Official updates released on 2023-10-16. <br>📌 **Safe Versions**: Upgrade to 1.4.15, 1.5.5, or 1.6.4+.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: <br>1. Disable HTML email rendering if possible. <br>2. Implement strict WAF rules to block SVG/script injection in email inputs. <br>3. Educate users not to open suspicious HTML emails.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: HIGH. <br>📅 **Priority**: Patch immediately. Since PoCs are public and exploitation is straightforward (view email), unpatched instances are actively at risk of account compromise.

Continue exploring

Vulnerability detail Full AI analysis (login) Roundcube CWE-79