Webmail Security

Roundcube Security Testing: XSS via Email, SSRF, IMAP Injection, Attachment Preview, and Default Credentials

📅 July 3, 2026 ⏱ 14 min read 🏷 Roundcube, Webmail Security, XSS Email, SSRF, IMAP Injection, Email Client Security

Installer Directory Exposure

# Roundcube /installer/ should be deleted or restricted after setup
# Accessible installer reveals database host, user, password, and IMAP config

ROUNDCUBE_URL="https://mail.example.com"

# Check if installer is still accessible
INSTALLER_STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
  "${ROUNDCUBE_URL}/installer/" 2>/dev/null)
echo "Installer HTTP status: ${INSTALLER_STATUS}"
# 200 = installer accessible — critical finding

if [ "$INSTALLER_STATUS" == "200" ]; then
  echo "CRITICAL: Roundcube installer is accessible"
  echo "This may expose database credentials and IMAP server configuration"

  # Check installer step 2 which shows test results
  curl -s "${ROUNDCUBE_URL}/installer/index.php?_step=2" 2>/dev/null | \
    grep -iE "(database|imap|smtp|password|host|user)" | \
    grep -v "input type=password" | head -20
fi

# Also check for exposed config.inc.php
curl -s -o /dev/null -w "%{http_code}" \
  "${ROUNDCUBE_URL}/config/config.inc.php" 2>/dev/null
# Should return 403 Forbidden — 200 means PHP config exposed as plaintext

Stored XSS via HTML Email

# Roundcube HTML email XSS — send a malicious HTML email to a target user
# The victim opens the email in Roundcube and the script executes in their session
# CVE-2023-5631: SVG-based XSS in Roundcube < 1.6.4

# Test payload using the classic Roundcube HTML sanitizer bypass
# (Send this as an HTML email to the Roundcube user)
cat << 'PAYLOAD'
To: victim@example.com
Subject: Test
Content-Type: text/html





test



PAYLOAD

# Verify Roundcube version (determines which CVEs apply)
curl -s "${ROUNDCUBE_URL}/" 2>/dev/null | \
  grep -oE 'Roundcube Webmail [0-9]+\.[0-9]+\.[0-9]+' | head -1
Roundcube Security Hardening

            Roundcube Security Hardening Checklist:
            

                
Delete or restrict the /installer/ directory — after completing Roundcube installation, delete the entire installer/ directory from the web root or configure your web server to deny access with a 403 response; the installer is the highest-severity misconfiguration in Roundcube deployments
                
Keep Roundcube updated — Roundcube has an extensive CVE history with XSS vulnerabilities in nearly every major version; subscribe to the Roundcube security advisory list and update immediately when XSS or RCE CVEs are published
                
Configure Content Security Policy headers — deploy strict CSP headers via your reverse proxy or web server to limit the impact of XSS vulnerabilities; a CSP that blocks inline scripts and data: URIs reduces XSS exploitability even in unpatched versions
                
Disable spell checker and URL preview — if not required, disable the spellcheck and message URL preview features in config.inc.php to eliminate associated SSRF vectors; these features make outbound HTTP requests based on email content
                
Configure HTML sanitization settings — review Roundcube's HTML allowed elements/attributes configuration; disable display of HTML emails from untrusted senders and use plain-text-first display as the default
                
Protect config files via web server — configure your web server to deny HTTP access to /config/, /temp/, /logs/, and /vendor/ directories; these directories must not be web-accessible
                
Enable Roundcube security headers — configure session-only cookies with HttpOnly and Secure flags; enable X-Frame-Options and X-Content-Type-Options in your reverse proxy configuration
            
        

            
Security Test
Method
Risk
            
/installer/ accessible after installation
GET /installer/ — reveals database credentials, IMAP server configuration, and SMTP settings in web browser
Critical
            
Stored XSS via HTML email (multiple CVEs)
Send crafted HTML email with SVG/style-based XSS payload — executes in victim's Roundcube session when email is opened
Critical
            
URL preview SSRF via email link hover
Email link containing internal URL — Roundcube server fetches URL for preview, enabling SSRF to internal network services
High
            
IMAP injection via email address special characters
Email address with IMAP special characters (}, {, \) — may inject commands into IMAP mailbox selection on backend server
High
            
HTML attachment preview credential phishing
Attach HTML file with fake login form — victim previews attachment in Roundcube context, enters credentials into phishing form
High
            
config.inc.php accessible via web server
GET /config/config.inc.php — exposes database password, IMAP credentials, DES key, and SMTP configuration as plaintext
Critical
        

        

            
Automate Roundcube Security Testing
            
Ironimo tests Roundcube deployments for accessible installer directory exposing database and IMAP credentials, known stored XSS payloads via HTML email content matching current Roundcube CVEs, URL preview SSRF to internal network services via email link content, HTML attachment preview enabling phishing within the webmail interface, configuration file web accessibility exposing database passwords and DES encryption keys, and Roundcube version detection for mapping against the current CVE database for targeted payload testing.
            Start free scan