Roundcube CVE-2023-5631: SVG XSS Zero-Day (Winter Vivern)

What to do

1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.4 is only the floor for this bug.
3. Migrate any 1.4 or 1.5 install to 1.6 or 1.7, since those branches no longer get fixes.
4. Search mail stores and network logs for ESET's indicators if an unpatched install was exposed in October 2023.
5. Treat mailboxes that opened the lure as read by the attacker and review what they held.

How to check if you are affected or compromised

• Search mailboxes for mail from team.managment@outlook[.]com or with the subject 'Get started in your Outlook'.
• Check proxy, DNS and firewall logs for recsecas[.]com and 38.180.76[.]31.
• Look for HTML messages carrying an SVG use element with a base64 href, the injection trick ESET documented.

What happened#

On October 16, 2023, Roundcube released 1.6.4, 1.5.5 and 1.4.15 to fix a stored cross-site scripting (XSS) flaw in how it handled SVG content inside HTML email (1.6.4 notice, 1.5.5 and 1.4.15 notice). The CVE record places the bug in the HTML sanitizer, rcube_washtml.php, and says a crafted message lets a remote attacker "load arbitrary JavaScript code" in the reader's session.

It was a zero-day. ESET found the Winter Vivern group exploiting it from October 11, 2023 against European government bodies and a think tank, and reported it to Roundcube the next day. The lure came from team.managment@outlook[.]com with the subject "Get started in your Outlook". It hid a base64-encoded SVG use element. Decoded, an onerror handler loaded a script from recsecas[.]com. Opening the message in the browser was enough. The final payload listed the victim's folders and sent their email to the attackers' server. Another researcher filed the same SVG trick as issue #9168 on October 13.

ESET, the CNA, scores it CVSS 3.1 6.1. NVD gives 5.4. CISA added it to the KEV catalog on October 26, 2023. The medium score undersells the outcome: a script that silently copies a victim's mailbox.

Who is affected#

Roundcube before 1.4.15, 1.5.x before 1.5.5 and 1.6.x before 1.6.4. Hosting panels and Linux distributions ship their own copies, which can lag upstream. Every Roundcube release since October 2023 has the fix.

Two caveats apply today. 1.4.15 was the last 1.4 release. And when 1.7.0 shipped on May 10, 2026, Roundcube said the 1.5.x series "is no longer supported and maintained" (announcement). Servers on those branches have this fix but miss many later ones.

Do you really need to act?#

Mostly, just confirm your versions. The bug is three years old and patched. The known campaign was narrow espionage against a small set of organizations. A Roundcube on a maintained, current release is not exposed.

The risk is the install nobody looks after: a forgotten webmail VM, an old control-panel bundle, a 1.4 or 1.5 server still in service. Roundcube is a repeat target for state-aligned groups, and an install too old to have this fix also lacks years of later security fixes. Upgrade those. If one was internet-facing in October 2023, check whether the hole was used.

What to do now#

1. Inventory every Roundcube instance, panel bundles included. Check the version under Settings > About, or with grep RCMAIL_VERSION program/include/iniset.php in the install directory, or dpkg -l roundcube-core for Debian packages.
2. Upgrade to 1.6.20 or 1.7.5, released October 19, 2026 (notice). Do not stop at 1.6.4.
3. Move any 1.4 or 1.5 install to 1.6 or 1.7. Those branches no longer receive fixes.

How to tell if you were hit#

The exploit ran in the reader's browser, so web server logs show little. Look at the mail and the network instead.

• Search mail stores for ESET's lure: sender team.managment@outlook[.]com or the subject "Get started in your Outlook". On Dovecot: doveadm search -A from team.managment@outlook.com.
• Check proxy, DNS and firewall logs for recsecas[.]com and the command-and-control address 38.180.76[.]31, which ESET first saw on September 28, 2023.
• Look for other HTML messages with an SVG use element pointing at a base64 data: URL.

Treat any mailbox that opened the lure as read by the attacker, and review what it contained.

Timeline#

• Oct 11, 2023 — Winter Vivern begins exploiting the flaw, per ESET telemetry.
• Oct 12, 2023 — ESET reports the vulnerability to Roundcube.
• Oct 14, 2023 — Roundcube commits the fix.
• Oct 16, 2023 — Roundcube releases 1.6.4, 1.5.5 and 1.4.15.
• Oct 18, 2023 — CVE-2023-5631 is published.
• Oct 25, 2023 — ESET publishes its research.
• Oct 26, 2023 — CISA adds the CVE to KEV, with a November 16 deadline.
• May 10, 2026 — Roundcube 1.7.0 ships, and the 1.5 series loses support.

Vulnerability records

• CVE-2023-5631 · KEV 2023-10-26 · Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Roundcube — Security update 1.6.4 released (Oct 16, 2023) roundcube.net
2. Roundcube — Security updates 1.5.5 and 1.4.15 released (Oct 16, 2023) roundcube.net
3. CVE record — CVE-2023-5631 cve.org
4. NVD — CVE-2023-5631 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2023-5631 cisa.gov
6. ESET Research — Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers welivesecurity.com
7. Roundcube GitHub — Issue #9168: XSS with svg use tag github.com
8. Roundcube — Roundcube 1.7.0 released (May 10, 2026) roundcube.net
9. Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026) roundcube.net