Roundcube CVE-2024-37383: SVG Animate XSS, Exploited
Fixed in May 2024 and exploited in a targeted phishing attack weeks later; any Roundcube on a current 1.6 or 1.7 release is safe, but forgotten installs on old builds are open to this and several later exploited bugs.
Must act: Anyone running Roundcube before 1.5.7 or 1.6.x before 1.6.7, including copies bundled by hosting panels and distributions, and anyone still on the unsupported 1.5 branch.
Can relax: Roundcube installs on 1.6.20 or 1.7.5 and later, and organizations that do not run Roundcube.
- Inventory every Roundcube instance, including panel bundles and distribution packages, and record its version.
- Upgrade to 1.6.20 or 1.7.5; stopping at 1.6.7 leaves later exploited bugs open.
- Move any 1.5.x install to 1.6 or 1.7; the 1.5 series is no longer maintained.