CVE-2024-42009

VendorroundcubeProductwebmailDiscoveredAug 5, 2024UpdatedNov 4, 2025

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

View graph Watch Export

CVSS v3.1

9.3 CRITICAL

EPSS

82.9%

probability of exploitation in 30 days

CISA KEV

Listed

confirmed active exploitation

News coverage

sources referencing this CVE

Related IOCs

seen in the same coverage

EPSS Trend

Aug 16, 2026 → Sep 1, 2026

▲ 3.26pp

79.6% → 82.9% over 3 tracked changes

CVSS v3.1 Detail

Attack VectorNETWORK

Attack ComplexityLOW

Privileges RequiredNONE

User InteractionREQUIRED

ScopeCHANGED

ConfidentialityHIGH

IntegrityHIGH

AvailabilityNONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N

Connections

3 relationships

CWE-79

source

Timeline

disclosure → media coverage

Aug 5, 2024

Disclosure — published as a CVE record. · last revised by NVD Nov 4, 2025

Jul 7, 2026

thehackernews.com reports: Suspected China-Aligned Hackers Exploit Roundcube Flaws Against Universities

Public PoC (6)

github.com/0xbassiouny1337/CVE-2024-42009 github.com/Bhanunamikaze/CVE-2024-42009 github.com/DaniTheHack3r/CVE-2024-42009-PoC github.com/Shubhankargupta691/CVE-2024-42009 github.com/ZaidArif47/CVE-2024-42009 github.com/segunakinsoyinu/CVE-2024-42009-roundcube-xss

Unverified third-party code — review before executing.