CVE-2020-35730

What is Roundcube Webmail?

Roundcube is a widely deployed open-source webmail client, frequently bundled with hosting control panels and self-managed mail servers. Because it renders untrusted, attacker-supplied email content by design, any gap in its HTML/text sanitization pipeline gives an attacker a direct line into a victim's authenticated webmail session the moment a malicious message is opened.

Overview

CVE-2020-35730 is a cross-site scripting vulnerability in Roundcube's handling of plain-text email messages that contain link reference-style syntax (a Markdown-like construct where a link definition elsewhere in the text is referenced by a bracketed label). The rcube_string_replacer.php component's linkref_addinindex function mishandled this construct, allowing an attacker to smuggle JavaScript into what Roundcube treats internally as safe plain text, resulting in script execution when the victim views the message.

Technical Details

The flaw (CWE-79, Cross-Site Scripting) is notable because it affects supposedly plain-text messages — a class of content that users and administrators often assume is inherently safe since it shouldn't support active HTML content. By abusing Roundcube's own link-reference auto-linking feature (which converts bracketed references into clickable links even in plain-text mail), an attacker could get script content injected into the rendered output. As with the related CVE-2020-13965, this scores 6.1 with Scope: Changed, reflecting that the XSS payload can affect the broader webmail session context, not just the immediate attachment view; exploitation requires the victim to open/view the crafted message but no attacker credentials.

Discovery

Fixed by the Roundcube project through its standard security release process; the Roundcube team's own advisory documents the flaw and credits the fix without extensive external researcher naming in the public record available here.

Exploitation Context

CISA's KEV catalog listing, added roughly two and a half years after the patch was released, confirms this vulnerability has been exploited in the wild — again illustrating how long unpatched webmail deployments remain viable targets, particularly in shared hosting and small-organization environments where update cycles lag. Webmail XSS bugs are a recurring tool in targeted phishing operations because a single crafted email can compromise a mailbox session without any separate malware delivery.

Remediation

1. Upgrade to Roundcube 1.4.10, 1.3.16, 1.2.13, or later (or the current supported release).
2. Disable or restrict automatic link-reference/auto-linking rendering features if an upgrade cannot be applied immediately.
3. Deploy Content Security Policy headers on the webmail interface to limit the blast radius of any XSS that executes.
4. Monitor inbound mail and webmail server logs for crafted messages using unusual link-reference syntax.
5. Prioritize upgrading any long-unpatched, internet-facing Roundcube instance given confirmed real-world exploitation.