---
title: "Roundcube XML attachment XSS (CVE-2020-13965)"
canonical: https://trickest.com/library/cve-2020-13965-roundcube-xml-attachment-xss
description: "Flag Roundcube Webmail hosts for CVE-2020-13965 by reading the version at GET /?_task=login. Floors 1.3.12 / 1.4.5. No XSS payload."
---

# Roundcube XML attachment XSS (CVE-2020-13965)

## Overview

This workflow finds Roundcube Webmail and sorts each host by whether its version falls below the CVE-2020-13965 fixed floors. CVE-2020-13965 is stored XSS through XML attachment preview on vulnerable Roundcube builds. This check never uploads an attachment and never injects an XSS payload. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/?_task=login`, fingerprints Roundcube from that login page, parses the version, and compares it to the per-branch floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when webmail nodes lag on older 1.3 / 1.4 lines. A host that stayed under its branch floor after the advisory is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/?_task=login` on each host and fingerprint Roundcube from the login page that exposes the product version.
3. Parse the version and compare it to the CVE-2020-13965 per-branch floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Roundcube was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/?_task=login` only. No XSS payload and no attachment upload.

## Sample output

The records below are illustrative and do not come from a real run. They show one Roundcube host below a CVE-2020-13965 floor, one at or above its branch floor, and one host that is not the product.

```jsonl
{"url": "https://webmail.example.com", "is_product": true, "product_version": "1.4.4", "vulnerable": true, "detail": "below branch floor 1.4.5"}
{"url": "https://webmail.example.org", "is_product": true, "product_version": "1.4.5", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Roundcube Webmail"}
```

```json
{"cve": "CVE-2020-13965", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Roundcube versions does this flag?

Builds below the per-branch floors in the graph: 1.3.12 and 1.4.5. A version picks the matching band, then compares to that band floor. The compare uses the version string `/?_task=login` itself served.

### Does an affected row mean XML attachment XSS worked?

No. The check only GETs `/?_task=login` and reads the version. It does not upload an XML attachment, does not inject a payload, and does not confirm XSS.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not authenticate or modify mail.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2020-13965?

Stored XSS in Roundcube Webmail through XML attachment preview on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Roundcube plaintext link XSS (CVE-2020-35730)](/library/cve-2020-35730-roundcube-plaintext-link-xss). Reach for it when you need the plaintext link XSS check on the same webmail fleet.
- [Roundcube ImageMagick RCE (CVE-2020-12641)](/library/cve-2020-12641-roundcube-imagemagick-rce). Reach for it when you need the ImageMagick RCE fingerprint.
- [Roundcube file disclosure (CVE-2017-16651)](/library/cve-2017-16651-roundcube-file-disclosure). Reach for it when you need the Roundcube file disclosure fingerprint.

---
_Markdown source of https://trickest.com/library/cve-2020-13965-roundcube-xml-attachment-xss._