Roundcube Releases Security Updates for Webmail
Updates address three vulnerabilities that could lead to theft of emails and contacts
Summary
Updates address three vulnerabilities that could lead to theft of emails and contacts
Affected platforms
The following platforms are known to be affected:
Threat details
CVE-2024-42009 exploited in-the-wild
Active exploitation of CVE-2024-42009 has been observed in the wild.
Additionally, a video demonstration proof-of-concept exploit for CVE-2024-42009 and CVE-2024-42008 has been published by a security researcher without technical details. The NHS England National Cyber Security Operations Centre CSOC assess further exploitation as highly likely.
Introduction
Roundcube has released security updates for its webmail product addressing two cross-site scripting (XXS) vulnerabilities. Roundcube webmail is a free and open-source webmail solution with a desktop-like user interface which runs on a standard LAMPP (Linux, Apache, MySQL/MariaDB, PHP, PHPMyAdmin) server.
The updates address vulnerabilities CVE-2024-42009 and CVE-2024-42008, which an unauthenticated attacker could exploit to steal emails or contacts and send emails from the victims account. Additionally, vulnerability CVE-2024-42010 could allow an attacker to access sensitive information.
Threat updates
| Date | Update |
|---|---|
| 9 Jun 2025 | CVE-2024-42009 exploited in-the-wild |
Remediation advice
Affected organisations are encouraged to review the security updates 1.6.8 and 1.5.8 and apply the relevant updates.
Definitive source of threat updates
CVE Vulnerabilities
Last edited: 9 June 2025 12:51 pm