🎯 New Report #3594137: Stored XSS in attachment-display exploitable through SameSite
🔺Severity: Medium
👽 Reporter: aikido security
⭐️ Reputation: 211
🛠 State: resolved
💼 Team: Nextcloud
💵 Bounty: null
🕐 Submitted: 2026-03-09
⏰ Disclosed: 2026-04-19 09:14:42
📝 Summary: A stored XSS vulnerability was discovered in the attachment-display feature of Roundcube. By uploading an HTML file and opening it through the display-attachment endpoint, the embedded script could execute under the Roundcube origin. The issue was caused by the lack of a restrictive Content Security Policy in the attachment display flow, unlike the general attachment viewer.
📂 Report JSON File: 3594137
@hackeronereports