--- title: "Roundcube CVE-2023-43770: Plain-Text Email XSS, Exploited" url: https://erroneo.us/security/briefs/roundcube-cve-2023-43770-plain-text-linkref-xss/ description: "Stored XSS via link references in plain-text mail, fixed in Roundcube 1.6.3/1.5.4/1.4.14 and used in Sednit's RoundPress spying. Confirm upgrades, then hunt." type: security-brief section: "Security Digest" date_published: 2023-09-15 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2023-43770"] severity: "medium" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # Roundcube CVE-2023-43770: Plain-Text Email XSS, Exploited **Verdict: Check exposure.** Patched in September 2023 and used by a Russia-linked espionage campaign within two weeks; confirm every Roundcube is on 1.6.20 or 1.7.5, and if an old install was exposed in 2023 or 2024, look for mail-forwarding rules that an upgrade does not remove. - **Who must act:** Anyone running Roundcube older than 1.6.3, 1.5.4 or 1.4.14, including copies bundled in hosting panels or old distribution packages, and anyone still on the unsupported 1.4 or 1.5 branches. - **Who can relax:** Installs kept current on Roundcube 1.6.x or 1.7.x, and organizations that do not run Roundcube. - **Affected:** Roundcube Webmail before 1.4.14; Roundcube Webmail 1.5.x before 1.5.4; Roundcube Webmail 1.6.x before 1.6.3 - **Fixed:** Roundcube 1.6.3 (Sep 15, 2023); Roundcube 1.5.4 and 1.4.14 (Sep 18, 2023); Recommended today: 1.6.20 or 1.7.5 (Oct 19, 2026) - **CVEs:** CVE-2023-43770 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version. 2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.3 is only the floor for this bug. 3. Move any 1.4 or 1.5 install to 1.6 or 1.7, since those branches no longer get fixes. 4. If an unpatched install was reachable in late 2023 or 2024, review every user's Sieve filters for redirect rules. 5. Reset passwords and end sessions for any user who opened a malicious message, and treat that mailbox as read by the attacker. ### How to check if you are affected - Search mail stores for messages from katecohen1984@portugalmail[.]pt, the sender of a September 2023 exploit email ESET tied to Sednit. - List users' Sieve scripts and look for redirect rules to outside addresses, such as srezoska@skiff[.]com from ESET's report. - Grep stored plain-text mail for a bracketed link reference containing a script tag, the pattern the fix blocks. ## What happened On September 15, 2023, Roundcube released 1.6.3 to fix a cross-site scripting (XSS) flaw "in handling of linkrefs in plain text messages," reported by Niraj Shivtarkar ([notice](https://roundcube.net/news/2023/09/15/security-update-1.6.3-released)). The same fix reached the older branches on September 18 in [1.5.4](https://github.com/roundcube/roundcubemail/releases/tag/1.5.4) and [1.4.14](https://github.com/roundcube/roundcubemail/releases/tag/1.4.14). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-43770) places the bug in `rcube_string_replacer.php`, the code that turns plain-text link references such as `[1] https://example.com` into links. The [fix](https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b) is small: the bracketed text may no longer contain `<` or `>`. Before it, a crafted reference could carry a script that ran when the message was displayed. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-43770) scores it CVSS 3.1 6.1. Exploitation followed fast. In its [Operation RoundPress](https://www.welivesecurity.com/en/eset-research/operation-roundpress/) report of May 15, 2025, ESET says it detected a spearphishing email exploiting CVE-2023-43770 on September 29, 2023. ESET links the campaign, with medium confidence, to Sednit, better known as APT28 or Fancy Bear. It says Sednit used an older Roundcube XSS, CVE-2020-35730, in 2023 and switched to this one in 2024. The payload, SpyPress.ROUNDCUBE, stole credentials, the address book and email. Some samples also created a Sieve rule that copies every incoming message to an attacker address. CISA added the flaw to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-43770) on February 12, 2024, with a March 4 deadline ([alert](https://www.cisa.gov/news-events/alerts/2024/02/12/cisa-adds-one-known-exploited-vulnerability-catalog)). [Help Net Security](https://www.helpnetsecurity.com/2024/02/13/cve-2023-43770/) noted that proof-of-concept code had been public for months. ## Who is affected Roundcube before 1.4.14, 1.5.x before 1.5.4 and 1.6.x before 1.6.3, including copies shipped by hosting panels and Linux distributions. Since 1.7.0 shipped on May 10, 2026, the 1.5 series "is no longer supported and maintained," and 1.6 gets only important security fixes ([announcement](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released)). ## Do you really need to act? Mostly, just confirm your versions. The bug is three years old and patched, and the known use was targeted espionage. But the medium score undersells it: opening one message could hand over a mailbox. Two things keep it relevant. First, a Sieve forwarding rule lives on the mail server. Upgrading Roundcube does not remove it, so a mailbox hit in 2023 or 2024 could still be copying mail today. Second, an install too old for this fix also lacks later ones. Roundcube now has 11 entries in KEV, including CVE-2023-5631, CVE-2024-42009, CVE-2025-49113 and CVE-2025-68461. A server on 1.6.3 is exposed to all four. ## What to do now 1. Inventory every Roundcube instance. Check Settings > About, run `grep RCMAIL_VERSION program/include/iniset.php` in the install directory, or use `dpkg -l roundcube-core` for Debian packages. 2. Upgrade to 1.6.20 or 1.7.5, released October 19, 2026 ([notice](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)). 3. Move any 1.4 or 1.5 install to 1.6 or 1.7. 4. If an unpatched install was reachable in late 2023 or 2024, run the checks below. Then reset passwords and end sessions for affected users. ## How to tell if you were hit The exploit runs in the reader's browser, so web logs show little. Look at the mail and the Sieve scripts. - Search mail stores for ESET's sender, katecohen1984@portugalmail[.]pt. On Dovecot: `doveadm search -A from katecohen1984@portugalmail.pt`. - List each user's filters with `doveadm sieve list -u user@example.com`. Look for `redirect` actions to outside addresses. ESET's sample used srezoska@skiff[.]com. - Grep stored plain-text mail for a bracketed reference holding a script tag, for example `grep -rlE '\[[^]]*