LogicalBreach Academy

Stored XSS in attachment-display exploitable through SameSite | Free Bug Bounty Writeup | LogicalBreach Academy

Writeups Cheatsheets Tools Collections Authors Noc Pricing

Back

Cross-site Scripting (XSS) - Stored (CWE-79)CVSS 6.7Hard

Stored XSS in attachment-display exploitable through SameSite

hackerone-reports

April 21, 2026

0 views

Save

€0

Vulnerability Summary

HackerOne disclosed report --> https://hackerone.com/reports/3594137 by aikido_security

Summary:

The compose attachments preview endpoint renders user-uploaded HTML files inline without a restrictive Content Security Policy, allowing JavaScript execution. By uploading an HTML file and opening it via display-attachment, the script runs in the Roundcube origin. Attacking a user is only possible by setting cookies on the domain, which can be done from any subdomain of the site where Roundcube is hosted.

Steps To Reproduce:

Set up a local Roundcube instance on an IP address (eg. 127.0.0.1)
Edit C:\Windows\System32\drivers\etc\hosts on Windows or /etc/hosts on Unix to contain the following entries: