CVE-2015-8770
HighSummary
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Risk Assessment
The organization may be exposed to unauthorized access to sensitive data or the potential execution of malicious code by remote users, which could lead to serious security breaches.
Recommendation
It is recommended to update Roundcube to the latest version to eliminate this vulnerability and review user permissions to restrict access to critical functions.
Other vulnerabilities in Roundcube
See all- CVE-2016-9920High
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
- CVE-2026-48846Medium
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Original NVD description (English source)
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.