CVE-2026-114718: Roundcube Webmail Password Plugin XSS

CVE-2026-114718 Overview

CVE-2026-114718 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in the Roundcube Webmail password plugin. Affected versions include Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping. A backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. The Roundcube maintainers published fixes in releases 1.6.20 and 1.7.5 on 2026-10-19.

Critical Impact
An attacker-controlled password backend can inject JavaScript into the Roundcube UI, enabling session abuse, webmail content manipulation, and credential theft when a user triggers a password change error.

Affected Products

Roundcube Webmail versions prior to 1.6.20
Roundcube Webmail 1.7.x versions prior to 1.7.5
Deployments using the password plugin with drivers such as DirectAdmin that reflect backend-controlled error text

Discovery Timeline

2026-10-19 - Roundcube releases security updates 1.6.20 and 1.7.5
2026-10-22 - CVE-2026-114718 published to NVD
2026-10-22 - Last updated in NVD database

Technical Details for CVE-2026-114718

Vulnerability Analysis

The Roundcube password plugin lets users change their mailbox password through pluggable drivers. When a driver returns an error, the plugin builds a user-facing message by appending the driver-supplied text to a localized reason string. The appended text was not HTML-escaped before rendering in the webmail interface, so any markup contained in the error payload was interpreted by the browser.

For backends like DirectAdmin, the error body is retrieved over the network from an external control panel. An operator or attacker able to influence that response can embed <script> tags or event handlers. When a Roundcube user attempts a password change and receives the error, the injected script executes in the user's authenticated webmail session.

Root Cause

The root cause is missing output encoding in two code paths. In plugins/password/password.php, the driver message was concatenated with $reason .= ' ' . $message;, bypassing Roundcube's standard output escaping helper. In plugins/password/drivers/directadmin.php, the driver attempted to sanitize its own output with strip_tags(), which does not neutralize attribute-based or event-handler XSS vectors and is unsuitable for HTML context escaping.

Attack Vector

Exploitation requires a backend able to inject text into the driver's error response and a Roundcube user who initiates a password change that fails. The attack is network-based with high complexity and requires user interaction, scoped across the webmail trust boundary. Successful injection yields script execution within the Roundcube origin.

php

// Patch in plugins/password/drivers/directadmin.php
        }

        if (isset($response['error']) && $response['error'] == 1) {
-            return ['code' => PASSWORD_ERROR, 'message' => strip_tags($response['text'])];
+            return ['code' => PASSWORD_ERROR, 'message' => $response['text']];
        }

        return PASSWORD_SUCCESS;

Source: Roundcube Commit 16bbca7

php

// Patch in plugins/password/password.php — escape driver message
        }

        if ($message) {
-            $reason .= ' ' . $message;
+            $reason .= ' ' . rcube::Q($message, 'strict', false);
        }

        return $reason;

Source: Roundcube Commit 9429885

The fix replaces strip_tags() with no sanitization at the driver layer and routes all driver messages through rcube::Q(), Roundcube's canonical HTML-escaping helper, before they are rendered.

Detection Methods for CVE-2026-114718

Indicators of Compromise

Roundcube password plugin error messages in UI logs that contain HTML tags, <script> payloads, or JavaScript URI schemes.
DirectAdmin API responses to CMD_API_USER_PASSWD or equivalent endpoints returning non-plain-text content in the text field.
Unexpected outbound requests from Roundcube user browsers immediately after a failed password change attempt.

Detection Strategies

Monitor web server logs for Roundcube password-change requests that return error responses containing markup or encoded script fragments.
Hunt in browser telemetry for script execution originating from the Roundcube /plugins/password/ interface after a form POST failure.
Review DirectAdmin or other password backend logs for operator accounts configured with error strings that include HTML or JavaScript.

Monitoring Recommendations

Enable Content Security Policy reporting on the Roundcube host to surface inline script violations tied to the password UI.
Alert on Roundcube version strings older than 1.6.20 or 1.7.5 across webmail inventory scans.
Capture and retain password driver response bodies at the proxy layer to support retrospective hunting.

How to Mitigate CVE-2026-114718

Immediate Actions Required

Upgrade Roundcube Webmail to 1.6.20 or 1.7.5 as published in the Roundcube Security Updates Announcement.
Audit the configured password_driver and restrict which operators can modify backend error strings in DirectAdmin or similar control panels.
Rotate webmail session secrets if logs indicate password-change errors containing suspicious markup.

Patch Information

The upstream fix is distributed in Roundcube Release 1.6.20 and Roundcube Release 1.7.5. The relevant commits are 16bbca7 and 94298856. Distribution tracking is available in Debian Bug Report #1151279.

Workarounds

Temporarily disable the password plugin by removing it from the plugins array in config/config.inc.php until the upgrade is applied.
Deploy a strict Content Security Policy that forbids inline scripts on the Roundcube origin to blunt XSS payloads.
If upgrade is deferred, restrict the password_driver setting to a backend whose error output is fully controlled by trusted administrators.

bash

# Example: disable the password plugin in Roundcube config
# Edit config/config.inc.php and remove 'password' from the plugins list
sed -i "s/'password',//g" /var/www/roundcube/config/config.inc.php

# Verify installed version meets the fixed release
grep -R "RCMAIL_VERSION" /var/www/roundcube/program/include/ | head -1