Actively exploited in the wild
Roundcube Webmail SQL Injection Vulnerability
Roundcube - Roundcube Webmail · Listed in the CISA KEV since 2023-06-22. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-44026
CriticalCVSS 9.8KEVSummary
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. The vulnerability may allow an attacker to manipulate database queries.
Risk Assessment
An attacker could execute unauthorized SQL queries, potentially leading to data leakage, modification, or deletion of information from the database. However, it requires interaction with the search function.
Recommendation
Upgrade Roundcube to version 1.3.17 or 1.4.12 (or later). If upgrade is not possible, consider restricting access to the search function or applying a WAF filter.
Other vulnerabilities in Roundcube
See all- CVE-2016-9920High
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
- CVE-2015-8770High
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
- CVE-2024-42009CriticalActively exploited
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- CVE-2026-48846Medium
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Original NVD description (English source)
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.