# CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

- Page: https://www.vulneraibility.com/cve/CVE-2024-42009
- CVSS: 9.3
- Known exploited: yes, in CISA KEV since 2025-06-09; CISA due date 2025-06-30
- EPSS: 82.88%
- Unvetted proof-of-concept code on GitHub: 6 GitHub proofs of concept · 1 Nuclei template (first 2025-02-11)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-08-20)
- Weakness: CWE-79
- Published: 2024-08-05

## Affected

- roundcube:webmail

## References

- [other] https://github.com/roundcube/roundcubemail/releases
- [other] https://sonarsource.com/blog/government-emails-at-risk-critical-cross-site-scripting-vulnerability-in-roundcube-webmail/
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.5.8
- [other] https://github.com/roundcube/roundcubemail/releases/tag/1.6.8
- [other] https://roundcube.net/news/2024/08/04/security-updates-1.6.8-and-1.5.8
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-42009

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.