---
title: "Roundcube CVE-2023-5631: SVG XSS Zero-Day (Winter Vivern)"
url: https://erroneo.us/security/briefs/roundcube-cve-2023-5631-svg-xss-winter-vivern/
description: "Stored XSS via SVG in HTML email, used by Winter Vivern in Oct 2023 to steal mail. Fixed in 1.6.4/1.5.5/1.4.15. Confirm you upgraded, then hunt."
type: security-brief
section: "Security Digest"
date_published: 2023-10-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-5631"]
severity: "medium"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Roundcube CVE-2023-5631: SVG XSS Zero-Day (Winter Vivern)

**Verdict: Check exposure.** Long patched and once used in targeted espionage; confirm every Roundcube you run is on 1.6.20 or 1.7.5, and hunt for the published indicators only if an old install was exposed in late 2023.

- **Who must act:** Anyone still running Roundcube older than 1.6.4, 1.5.5 or 1.4.15, including copies bundled in hosting panels or old distribution packages, and anyone still on the unsupported 1.4 or 1.5 branches.
- **Who can relax:** Installs on a maintained Roundcube release (1.6.x or 1.7.x, kept current) and organizations that do not run Roundcube.
- **Affected:** Roundcube Webmail before 1.4.15; Roundcube Webmail 1.5.x before 1.5.5; Roundcube Webmail 1.6.x before 1.6.4
- **Fixed:** Roundcube 1.6.4, 1.5.5, 1.4.15 (Oct 16, 2023); Recommended today: 1.6.20 or 1.7.5 (Oct 19, 2026)
- **CVEs:** CVE-2023-5631
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory every Roundcube instance, including hosting-panel bundles, and record its version.
2. Upgrade to Roundcube 1.6.20 or 1.7.5; 1.6.4 is only the floor for this bug.
3. Migrate any 1.4 or 1.5 install to 1.6 or 1.7, since those branches no longer get fixes.
4. Search mail stores and network logs for ESET's indicators if an unpatched install was exposed in October 2023.
5. Treat mailboxes that opened the lure as read by the attacker and review what they held.

### How to check if you are affected

- Search mailboxes for mail from team.managment@outlook[.]com or with the subject 'Get started in your Outlook'.
- Check proxy, DNS and firewall logs for recsecas[.]com and 38.180.76[.]31.
- Look for HTML messages carrying an SVG use element with a base64 href, the injection trick ESET documented.

## What happened

On October 16, 2023, Roundcube released 1.6.4, 1.5.5 and 1.4.15 to fix a stored cross-site scripting (XSS) flaw in how it handled SVG content inside HTML email ([1.6.4 notice](https://roundcube.net/news/2023/10/16/security-update-1.6.4-released), [1.5.5 and 1.4.15 notice](https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15)). The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-5631) places the bug in the HTML sanitizer, `rcube_washtml.php`, and says a crafted message lets a remote attacker "load arbitrary JavaScript code" in the reader's session.

It was a zero-day. [ESET](https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/) found the Winter Vivern group exploiting it from October 11, 2023 against European government bodies and a think tank, and reported it to Roundcube the next day. The lure came from team.managment@outlook[.]com with the subject "Get started in your Outlook". It hid a base64-encoded SVG `use` element. Decoded, an `onerror` handler loaded a script from recsecas[.]com. Opening the message in the browser was enough. The final payload listed the victim's folders and sent their email to the attackers' server. Another researcher filed the same SVG trick as [issue #9168](https://github.com/roundcube/roundcubemail/issues/9168) on October 13.

ESET, the CNA, scores it CVSS 3.1 6.1. [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-5631) gives 5.4. CISA added it to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631) on October 26, 2023. The medium score undersells the outcome: a script that silently copies a victim's mailbox.

## Who is affected

Roundcube before 1.4.15, 1.5.x before 1.5.5 and 1.6.x before 1.6.4. Hosting panels and Linux distributions ship their own copies, which can lag upstream. Every Roundcube release since October 2023 has the fix.

Two caveats apply today. 1.4.15 was the last 1.4 release. And when 1.7.0 shipped on May 10, 2026, Roundcube said the 1.5.x series "is no longer supported and maintained" ([announcement](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released)). Servers on those branches have this fix but miss many later ones.

## Do you really need to act?

Mostly, just confirm your versions. The bug is three years old and patched. The known campaign was narrow espionage against a small set of organizations. A Roundcube on a maintained, current release is not exposed.

The risk is the install nobody looks after: a forgotten webmail VM, an old control-panel bundle, a 1.4 or 1.5 server still in service. Roundcube is a repeat target for state-aligned groups, and an install too old to have this fix also lacks years of later security fixes. Upgrade those. If one was internet-facing in October 2023, check whether the hole was used.

## What to do now

1. Inventory every Roundcube instance, panel bundles included. Check the version under Settings > About, or with `grep RCMAIL_VERSION program/include/iniset.php` in the install directory, or `dpkg -l roundcube-core` for Debian packages.
2. Upgrade to 1.6.20 or 1.7.5, released October 19, 2026 ([notice](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)). Do not stop at 1.6.4.
3. Move any 1.4 or 1.5 install to 1.6 or 1.7. Those branches no longer receive fixes.

## How to tell if you were hit

The exploit ran in the reader's browser, so web server logs show little. Look at the mail and the network instead.

- Search mail stores for ESET's lure: sender team.managment@outlook[.]com or the subject "Get started in your Outlook". On Dovecot: `doveadm search -A from team.managment@outlook.com`.
- Check proxy, DNS and firewall logs for recsecas[.]com and the command-and-control address 38.180.76[.]31, which ESET first saw on September 28, 2023.
- Look for other HTML messages with an SVG `use` element pointing at a base64 `data:` URL.

Treat any mailbox that opened the lure as read by the attacker, and review what it contained.

## Timeline

- Oct 11, 2023 — Winter Vivern begins exploiting the flaw, per ESET telemetry.
- Oct 12, 2023 — ESET reports the vulnerability to Roundcube.
- Oct 14, 2023 — Roundcube commits the fix.
- Oct 16, 2023 — Roundcube releases 1.6.4, 1.5.5 and 1.4.15.
- Oct 18, 2023 — CVE-2023-5631 is published.
- Oct 25, 2023 — ESET publishes its research.
- Oct 26, 2023 — CISA adds the CVE to KEV, with a November 16 deadline.
- May 10, 2026 — Roundcube 1.7.0 ships, and the 1.5 series loses support.

## Sources

1. [Roundcube — Security update 1.6.4 released (Oct 16, 2023)](https://roundcube.net/news/2023/10/16/security-update-1.6.4-released)
2. [Roundcube — Security updates 1.5.5 and 1.4.15 released (Oct 16, 2023)](https://roundcube.net/news/2023/10/16/security-updates-1.5.5-and-1.4.15)
3. [CVE record — CVE-2023-5631](https://www.cve.org/CVERecord?id=CVE-2023-5631)
4. [NVD — CVE-2023-5631](https://nvd.nist.gov/vuln/detail/CVE-2023-5631)
5. [CISA — Known Exploited Vulnerabilities: CVE-2023-5631](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-5631)
6. [ESET Research — Winter Vivern exploits zero-day vulnerability in Roundcube Webmail servers](https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/)
7. [Roundcube GitHub — Issue #9168: XSS with svg use tag](https://github.com/roundcube/roundcubemail/issues/9168)
8. [Roundcube — Roundcube 1.7.0 released (May 10, 2026)](https://roundcube.net/news/2026/05/10/roundcube-1.7.0-released)
9. [Roundcube — Security updates 1.6.20 and 1.7.5 (Oct 19, 2026)](https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5)

---
Source page: https://erroneo.us/security/briefs/roundcube-cve-2023-5631-svg-xss-winter-vivern/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt