---
title: "Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024"
url: https://erroneo.us/security/briefs/roundcube-cve-2020-13965-xml-attachment-xss/
description: "A 2020 Roundcube XSS via text/xml attachment previews, fixed in 1.4.5/1.3.12, joined KEV in June 2024. Anyone still that old needs 1.6.20/1.7.5."
type: security-brief
section: "Security Digest"
date_published: 2020-06-02
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2020-13965"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Roundcube CVE-2020-13965: XML Attachment XSS, KEV in 2024

**Verdict: Check exposure.** Fixed in June 2020; if any Roundcube you run is still on 1.4.4 or older, this bug is the least of its problems, so upgrade it to a current release and check mailboxes for signs of theft.

- **Who must act:** Anyone running Roundcube older than 1.4.5 or 1.3.12, including copies bundled in old hosting panels or appliances, and admins who re-added text/xml to client_mimetypes.
- **Who can relax:** Sites on a current Roundcube 1.6 LTS or 1.7 release with default attachment preview settings.
- **Affected:** Roundcube Webmail before 1.3.12; Roundcube Webmail 1.4.x before 1.4.5
- **Fixed:** Roundcube 1.4.5 and 1.3.12 (Jun 2, 2020); Current releases 1.6.20 and 1.7.5 (Oct 19, 2026) also fix later exploited bugs
- **CVEs:** CVE-2020-13965
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Check the version on every Roundcube install with grep RCMAIL_VERSION program/include/iniset.php.
2. Upgrade anything older than 1.6.20 or 1.7.5 to a current release; the October 2026 fixes cover only the 1.6 LTS and 1.7 branches.
3. Make sure client_mimetypes in config/config.inc.php does not list text/xml.
4. Include Roundcube copies bundled in hosting control panels and appliances in the inventory.
5. If an old install served users after mid-2020, review mailbox forwarding rules, identities and sessions, and reset passwords for at-risk accounts.

### How to check if you are affected

- Search the mail store for messages from outside senders that carry text/xml attachments, especially ones containing script or XSL content.
- Check users' Roundcube settings and the mail server's sieve filters for forwarding rules or identities nobody created.
- Review web server logs for attachment preview requests followed by unexpected settings or filter changes from the same session.

## What happened

On June 2, 2020, Roundcube released [1.4.5 and 1.3.12](https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12) with a fix for "cross-site scripting (XSS) via malicious XML attachment", credited to researcher Matei "Mal" Badanoiu. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2020-13965) explains the cause: text/xml was among the attachment types Roundcube opened in a browser preview. A crafted XML file could get past the script filter and run JavaScript in the victim's webmail session when they opened or previewed it, according to [Badanoiu's advisory](https://github.com/mbadanoiu/CVE-2020-13965). The [fix commit](https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3) removed text/xml from the default `client_mimetypes` preview list. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-13965) scores it CVSS 3.1 6.1.

Four years later, on [June 26, 2024](https://www.cisa.gov/news-events/alerts/2024/06/26/cisa-adds-three-known-exploited-vulnerabilities-catalog), CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965), with a July 17 deadline and ransomware use "Unknown".

### Why a 2020 bug landed in KEV in 2024

CISA did not say what evidence prompted the addition, and as of Oct 23, 2026 no public report ties CVE-2020-13965 to a named campaign or actor. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-exploited-geoserver-linux-kernel-and-roundcube-vulnerabilities/) noted that none of that day's three additions had been publicly reported as exploited before CISA's warning, and that proof-of-concept code had been public since shortly after the 2020 patch. The broader context is clear, though. Webmail is an attractive target because one script running in a session can read and forward a victim's mail, and Roundcube has a long KEV history: CVE-2023-5631 (added October 2023), CVE-2023-43770, CVE-2024-37383, CVE-2024-42009, CVE-2025-49113 and CVE-2025-68461 all followed. Old installs give attackers a choice of known bugs.

## Who is affected

Roundcube before 1.3.12 and 1.4.x before 1.4.5. That also covers older copies bundled in hosting control panels and appliances, which often lag behind upstream. Admins who customized `client_mimetypes` on a patched version and added `text/xml` back could also have reopened the preview path the fix closed.

## Do you really need to act?

For most sites, no: this was fixed six years ago. The bug itself also has limits. The attacker needs no account, but the victim has to open or preview the attachment, and the script runs with that user's webmail rights, not on the server. The realistic outcome is a stolen mailbox, a planted forwarding rule or a hijacked session. But a server still exposed to CVE-2020-13965 is also exposed to every later Roundcube bug on that list, including the CVE-2025-49113 deserialization flaw. Patching to 1.4.5 alone is pointless. Roundcube's latest releases are [1.6.20 and 1.7.5](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5), from October 19, 2026.

## What to do now

1. Check each install: `grep RCMAIL_VERSION program/include/iniset.php`.
2. Upgrade anything below 1.6.20 or 1.7.5 to a current release.
3. Run `grep -n client_mimetypes config/config.inc.php` and make sure the list does not include `text/xml`.
4. Find Roundcube copies inside control panels and appliances too.

## How to tell if you were hit

- Search the mail store for external messages with `text/xml` attachments that contain script or XSL content.
- Look for forwarding rules, sieve filters or identities that users did not create.
- In web logs, look for attachment previews followed by settings or filter changes in the same session.

## Timeline

- Jun 2, 2020 — Roundcube 1.4.5 and 1.3.12 fix the XML attachment XSS.
- Jun 9, 2020 — CVE-2020-13965 is published.
- Jun 26, 2024 — CISA adds it to KEV.
- Oct 19, 2026 — Roundcube 1.6.20 and 1.7.5 are the current security releases.

## Sources

1. [Roundcube — Security updates 1.4.5 and 1.3.12 (Jun 2, 2020)](https://roundcube.net/news/2020/06/02/security-updates-1.4.5-and-1.3.12)
2. [Roundcube GitHub — Security: Fix cross-site scripting (XSS) via malicious XML attachment](https://github.com/roundcube/roundcubemail/commit/884eb611627ef2bd5a2e20e02009ebb1eceecdc3)
3. [CVE record — CVE-2020-13965](https://www.cve.org/CVERecord?id=CVE-2020-13965)
4. [NVD — CVE-2020-13965](https://nvd.nist.gov/vuln/detail/CVE-2020-13965)
5. [CISA — Known Exploited Vulnerabilities: CVE-2020-13965](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-13965)
6. [CISA — CISA Adds Three Known Exploited Vulnerabilities to Catalog (Jun 26, 2024)](https://www.cisa.gov/news-events/alerts/2024/06/26/cisa-adds-three-known-exploited-vulnerabilities-catalog)
7. [Matei Badanoiu — CVE-2020-13965: Cross-Site Scripting via Malicious XML Attachment in Roundcube Webmail](https://github.com/mbadanoiu/CVE-2020-13965)
8. [Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026)](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)
9. [SecurityWeek — CISA Warns of Exploited GeoServer, Linux Kernel, Roundcube Vulnerabilities](https://www.securityweek.com/cisa-warns-of-exploited-geoserver-linux-kernel-and-roundcube-vulnerabilities/)

---
Source page: https://erroneo.us/security/briefs/roundcube-cve-2020-13965-xml-attachment-xss/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt