CVE-2026-114718

Name	CVE-2026-114718
Description	Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1151279

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
roundcube (PTS)	bookworm	1.6.5+dfsg-1+deb12u9	vulnerable
	bookworm (security)	1.6.5+dfsg-1+deb12u12	vulnerable
	trixie	1.6.18+dfsg-0+deb13u1	vulnerable
	trixie (security)	1.6.19+dfsg-0+deb13u1	vulnerable
	forky, sid	1.6.20+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
roundcube	source	(unstable)	1.6.20+dfsg-1			1151279

Notes

https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Fixed by: https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7 (1.6.20)