CVE-2026-54432

Roundcube Webmail versions prior to 1.6.17 and 1.7.x before 1.7.2 are vulnerable to Stored Cross-Site Scripting (XSS) due to improper escaping of the attachment MIME type on the attachment-validation warning page. This vulnerability could allow attackers to inject malicious scripts, potentially compromising user accounts and sensitive data. Organizations using affected versions should prioritize patching to mitigate the risk of exploitation.