CVE-2024-42009

CVE-2024-42009 – Reflected XSS in Roundcube Webmail 📌 Overview This repository contains a Nuclei template and supporting resources to safely demonstrate and validate CVE-2024-42009 , a critical reflected XSS vulnerability in Roundcube Webmail. The flaw resides in the messagebody function in...

CVE-2024-42009-PoC

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Roundcube Webmail Overview This repository contains a proof-of-concept PoC exploit for CVE-2024-42009 a stored Cross-Site Scripting XSS vulnerability in Roundcube Webmail version 1.6.7 and other several versions. The exploit demonstrates...

GHSA-9W6W-8X3C-HFQP Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7hxc-f267-h5q7. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal...

Duplicate Advisory: Craft CMS: Incorrect path validation could potentially lead to path traversal

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7hxc-f267-h5q7. This link is maintained to preserve external references. Original Description Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal...

CVE-2026-72783

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72783

Craft CMS versions >= 5.0.0-RC1 before 5.10.6 and >= 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the Local file system class’s ensurePathIsContained function. The vulnerability stems from validating the path before normalization, creating a desanitization-style ...

CVE-2026-72783

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

EUVD-2026-56107

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

CVE-2026-72783 Craft CMS 5.0.0-RC1 before 5.10.6 Path Traversal via ensurePathIsContained

Craft CMS versions = 5.0.0-RC1 before 5.10.6 and = 4.0.0-RC1 before 4.18.2 contain a theoretical path traversal weakness in the ensurePathIsContained function of the Local file system class. The order of operations validates the path before normalization, so normalization could invalidate prior...

Craft CMS: Incorrect path validation could potentially lead to path traversal

The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered. When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn use...

GHSA-7HXC-F267-H5Q7 Craft CMS: Incorrect path validation could potentially lead to path traversal

The ensurePathIsContained function of the Local file system class is theoretically vulnerable to path traversal, although no exploitable scenario has been discovered. When a file is read, an Asset object uses the getFileStream method of the Volume where the asset file is stored, which in turn use...

PT-2026-70201

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description A theoretical path traversal weakness exists in the ensurePathIsContained function of the Local file system class. The issue arises because the...

Linux Distros Unpatched Vulnerability : CVE-2024-42009

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a...

RoundCube Webmail Cross-Site Scripting Vulnerability

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...

VulnCheck KEV: CVE-2024-42009

RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...

Exploit for Cross-site Scripting in Roundcube Webmail

CVE-2024-42009 PoC: Email Capture Listener & XSS Exploit in Ro...

Roundcube Webmail 1.5.x < 1.5.8 / 1.6.x < 1.6.8 Multiple Vulnerabilities

The remote web server is running Roundcube Webmail version 1.5.x prior to 1.5.8 or 1.6.x prior to 1.6.8. It is, therefore, affected by multiple vulnerabilities. - A Cross-Site Scripting vulnerability in rcmailactionmailget-run in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote...

SUSE CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...

CVE-2024-42009

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in messagebody in program/actions/mail/show.php...