Medium
Security advisory
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4068
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:28 UTC · Revision 1
Source evidence
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.
osv:CVE-2016-4068
Complete source record
{
"id": "cc1e312689b11b4d222c216987eb6c9385189be3362aaa301e5ae5a8f0cf9116",
"url": "https://osv.dev/vulnerability/CVE-2016-4068",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4068",
"summary": "Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.0.9 and 1.1.x before 1.1.5 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG, a different vulnerability than CVE-2015-8864.",
"evidence": "osv:CVE-2016-4068",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2016-4068",
"aliases": [
"CVE-2016-4068"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/roundcube/roundcubemail",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2c0a550105f22e17307198bb295f83c210fb7cb5"
},
{
"introduced": "190ae4f800b2d40c0edb579b34c1b188089c2a6a"
},
{
"last_affected": "772e08fa2a7211e68aa6179811cf82ac124c9bf2"
},
{
"fixed": "40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
},
{
"fixed": "cde7a9eb74b6fd6315885c30c0763e0ee5332499"
},
{
"fixed": "25bc871ee79a6d469822d999b09c9b5d73fccf1f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "1.0.8"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:roundcube:webmail:1.1:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1"
},
{
"last_affected": "1.1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:roundcube:webmail:1.1:beta:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-beta"
},
{
"last_affected": "1.1-beta"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:roundcube:webmail:1.1:rc:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1-rc"
},
{
"last_affected": "1.1-rc"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:roundcube:webmail:1.1.4:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.1.4"
},
{
"last_affected": "1.1.4"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "40d7342dd9c9bd2a1d613edc848ed95a4d71aa18"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "cde7a9eb74b6fd6315885c30c0763e0ee5332499"
}
],
"source": "REFERENCES_TAG",
"original_tag": "1.0.9"
},
{
"range": [
{
"fixed": "25bc871ee79a6d469822d999b09c9b5d73fccf1f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "1.1.5"
}
]
}
}
],
"versions": [
"1.1",
"1.1-beta",
"1.1-rc",
"1.1.4",
"1.0.8",
"1.2-beta",
"1.0.7",
"1.1.3",
"1.0.6",
"1.1.2",
"1.1.1",
"1.1.0",
"1.0.5",
"1.0.4",
"1.0.3",
"1.0.2",
"1.0.1",
"1.0.0",
"v1.0-rc",
"v0.1-beta2"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4068.json"
}
}
],
"modified": "2026-10-24T10:47:34.048046978Z",
"provider": "osv",
"references": [
"https://github.com/roundcube/roundcubemail/issues/4949",
"https://github.com/roundcube/roundcubemail/releases/tag/1.0.9",
"https://github.com/roundcube/roundcubemail/releases/tag/1.1.5",
"https://github.com/roundcube/roundcubemail/wiki/Changelog#release-115",
"https://github.com/roundcube/roundcubemail/commit/40d7342dd9c9bd2a1d613edc848ed95a4d71aa18#commitcomment-15294218"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.1"
},
{
"last_affected": "42.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*",
"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:opensuse",
"extracted_events": [
{
"range": [
{
"introduced": "13.1"
},
{
"last_affected": "13.1"
},
{
"introduced": "13.2"
},
{
"last_affected": "13.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:a:roundcube:roundcube_webmail:1.1.1:*:*:*:*:*:*:*",
"cpe:2.3:a:roundcube:roundcube_webmail:1.1.2:*:*:*:*:*:*:*",
"cpe:2.3:a:roundcube:roundcube_webmail:1.1.3:*:*:*:*:*:*:*"
],
"vendor_product": "roundcube:roundcube_webmail",
"extracted_events": [
{
"range": [
{
"introduced": "1.1.1"
},
{
"last_affected": "1.1.1"
},
{
"introduced": "1.1.2"
},
{
"last_affected": "1.1.2"
},
{
"introduced": "1.1.3"
},
{
"last_affected": "1.1.3"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4068",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 441326,
"published_at": "2017-04-13T14:59:01.713+00:00"
}