---
title: "Roundcube plaintext link XSS (CVE-2020-35730)"
canonical: https://trickest.com/library/cve-2020-35730-roundcube-plaintext-link-xss
description: "Flag Roundcube Webmail hosts for CVE-2020-35730 by reading the version at GET /?_task=login. Floors 1.2.13-1.4.10. No XSS payload."
---

# Roundcube plaintext link XSS (CVE-2020-35730)

## Overview

This workflow finds Roundcube Webmail and sorts each host by whether its version falls below the CVE-2020-35730 fixed floors. CVE-2020-35730 is stored XSS through plaintext email link references on vulnerable Roundcube builds. This check never injects an XSS payload and never opens a mailbox. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/?_task=login`, fingerprints Roundcube from that login page, parses the version, and compares it to the per-branch floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). An affected row is a version signal only.

Run it on a schedule when webmail nodes lag on older 1.2 / 1.3 / 1.4 lines. A host that stayed under its branch floor after the advisory is the reason the same fingerprint stays useful.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/?_task=login` on each host and fingerprint Roundcube from the login page that exposes the product version.
3. Parse the version and compare it to the CVE-2020-35730 per-branch floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Roundcube was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/?_task=login` only. No XSS payload and no mailbox interaction.

## Sample output

The records below are illustrative and do not come from a real run. They show one Roundcube host below a CVE-2020-35730 floor, one at or above its branch floor, and one host that is not the product.

```jsonl
{"url": "https://webmail.example.com", "is_product": true, "product_version": "1.4.9", "vulnerable": true, "detail": "below branch floor 1.4.10"}
{"url": "https://webmail.example.org", "is_product": true, "product_version": "1.4.10", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Roundcube Webmail"}
```

```json
{"cve": "CVE-2020-35730", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Roundcube versions does this flag?

Builds below the per-branch floors in the graph: 1.2.13, 1.3.16, and 1.4.10. A version picks the matching band, then compares to that band floor. The compare uses the version string `/?_task=login` itself served.

### Does an affected row mean stored XSS worked?

No. The check only GETs `/?_task=login` and reads the version. It does not inject a plaintext link payload, does not open a mailbox, and does not confirm XSS.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not authenticate or modify mail.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2020-35730?

Stored XSS in Roundcube Webmail through plaintext email link references on vulnerable builds. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Roundcube XML attachment XSS (CVE-2020-13965)](/library/cve-2020-13965-roundcube-xml-attachment-xss). Reach for it when you need the XML attachment XSS check on the same webmail fleet.
- [Roundcube ImageMagick RCE (CVE-2020-12641)](/library/cve-2020-12641-roundcube-imagemagick-rce). Reach for it when you need the ImageMagick RCE fingerprint.
- [Roundcube file disclosure (CVE-2017-16651)](/library/cve-2017-16651-roundcube-file-disclosure). Reach for it when you need the Roundcube file disclosure fingerprint.

---
_Markdown source of https://trickest.com/library/cve-2020-35730-roundcube-plaintext-link-xss._