Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024

What to do

1. Check the version on every Roundcube install with grep RCMAIL_VERSION program/include/iniset.php.
2. Upgrade anything older than 1.6.20 or 1.7.5 to a current release; the October 2026 fixes cover only the 1.6 LTS and 1.7 branches.
3. Make sure client_mimetypes in config/config.inc.php does not list text/xml.
4. Include Roundcube copies bundled in hosting control panels and appliances in the inventory.
5. If an old install served users after mid-2020, review mailbox forwarding rules, identities and sessions, and reset passwords for at-risk accounts.

How to check if you are affected or compromised

• Search the mail store for messages from outside senders that carry text/xml attachments, especially ones containing script or XSL content.
• Check users' Roundcube settings and the mail server's sieve filters for forwarding rules or identities nobody created.
• Review web server logs for attachment preview requests followed by unexpected settings or filter changes from the same session.

What happened#

On June 2, 2020, Roundcube released 1.4.5 and 1.3.12 with a fix for "cross-site scripting (XSS) via malicious XML attachment", credited to researcher Matei "Mal" Badanoiu. The CVE record explains the cause: text/xml was among the attachment types Roundcube opened in a browser preview. A crafted XML file could get past the script filter and run JavaScript in the victim's webmail session when they opened or previewed it, according to Badanoiu's advisory. The fix commit removed text/xml from the default client_mimetypes preview list. NVD scores it CVSS 3.1 6.1.

Four years later, on June 26, 2024, CISA added it to the KEV catalog, with a July 17 deadline and ransomware use "Unknown".

Why a 2020 bug landed in KEV in 2024#

CISA did not say what evidence prompted the addition, and as of Oct 23, 2026 no public report ties CVE-2020-13965 to a named campaign or actor. SecurityWeek noted that none of that day's three additions had been publicly reported as exploited before CISA's warning, and that proof-of-concept code had been public since shortly after the 2020 patch. The broader context is clear, though. Webmail is an attractive target because one script running in a session can read and forward a victim's mail, and Roundcube has a long KEV history: CVE-2023-5631 (added October 2023), CVE-2023-43770, CVE-2024-37383, CVE-2024-42009, CVE-2025-49113 and CVE-2025-68461 all followed. Old installs give attackers a choice of known bugs.

Who is affected#

Roundcube before 1.3.12 and 1.4.x before 1.4.5. That also covers older copies bundled in hosting control panels and appliances, which often lag behind upstream. Admins who customized client_mimetypes on a patched version and added text/xml back could also have reopened the preview path the fix closed.

Do you really need to act?#

For most sites, no: this was fixed six years ago. The bug itself also has limits. The attacker needs no account, but the victim has to open or preview the attachment, and the script runs with that user's webmail rights, not on the server. The realistic outcome is a stolen mailbox, a planted forwarding rule or a hijacked session. But a server still exposed to CVE-2020-13965 is also exposed to every later Roundcube bug on that list, including the CVE-2025-49113 deserialization flaw. Patching to 1.4.5 alone is pointless. Roundcube's latest releases are 1.6.20 and 1.7.5, from October 19, 2026.

What to do now#

1. Check each install: grep RCMAIL_VERSION program/include/iniset.php.
2. Upgrade anything below 1.6.20 or 1.7.5 to a current release.
3. Run grep -n client_mimetypes config/config.inc.php and make sure the list does not include text/xml.
4. Find Roundcube copies inside control panels and appliances too.

How to tell if you were hit#

• Search the mail store for external messages with text/xml attachments that contain script or XSL content.
• Look for forwarding rules, sieve filters or identities that users did not create.
• In web logs, look for attachment previews followed by settings or filter changes in the same session.

Timeline#

• Jun 2, 2020 — Roundcube 1.4.5 and 1.3.12 fix the XML attachment XSS.
• Jun 9, 2020 — CVE-2020-13965 is published.
• Jun 26, 2024 — CISA adds it to KEV.
• Oct 19, 2026 — Roundcube 1.6.20 and 1.7.5 are the current security releases.

Vulnerability records

• CVE-2020-13965 · KEV 2024-06-26 · An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Roundcube — Security updates 1.4.5 and 1.3.12 (Jun 2, 2020) roundcube.net
2. Roundcube GitHub — Security: Fix cross-site scripting (XSS) via malicious XML attachment github.com
3. CVE record — CVE-2020-13965 cve.org
4. NVD — CVE-2020-13965 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2020-13965 cisa.gov
6. CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jun 26, 2024) cisa.gov
7. Matei Badanoiu — CVE-2020-13965: Cross-Site Scripting via Malicious XML Attachment in Roundcube Webmail github.com
8. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net

Coverage and analysis

1. SecurityWeek — CISA Warns of Exploited GeoServer, Linux Kernel, Roundcube Vulnerabilities securityweek.com