Roundcube vulnerabilities
7 known CVE vulnerabilities in Roundcube, translated and rated.
- CVE-2016-9920High
In Roundcube versions before 1.1.7 and 1.2.x before 1.2.3, the lack of SMTP server configuration and the enabling of the sendmail program does not properly restrict the use of custom envelope-from addresses on the sendmail command line. This allows remote authenticated users to execute arbitrary code via a modified HTTP request that sends a crafted e-mail message.
- CVE-2015-8770High
Directory traversal vulnerability in the set_skin function in rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
- CVE-2024-42009CriticalActively exploited
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
- CVE-2023-5631MediumActively exploited
Stored XSS vulnerability in Roundcube before 1.4.15, 1.5.5, and 1.6.4 allows a remote attacker to load arbitrary JavaScript code via an HTML email with a crafted SVG document.
- CVE-2023-43770MediumActively exploited
XSS vulnerability in Roundcube before 1.4.14, 1.5.4, and 1.6.3 allows XSS via text/plain email messages with crafted links.
- CVE-2021-44026CriticalActively exploited
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. The vulnerability may allow an attacker to manipulate database queries.
- CVE-2026-48846Medium
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS