Roundcube Webmail vulnerabilities

Roundcube Webmail before 1.6.18 and 1.7.3 has a vulnerability in the modoboa driver of the password plugin that could leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver.

Roundcube Webmail before 1.6.18 and 1.7.3 has insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure, e.g., if stylesheet links point to local network hosts. This is due to incomplete fixes for CVE-2026-35540, CVE-2026-48843, and CVE-2026-62643.

Roundcube Webmail before 1.6.18 and 1.7.3 has improper rule name quoting that could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This affects only instances using the managesieve plugin.

Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to stored XSS in the "Add to address book" action.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS proxy were not validated, which may result in information disclosure or XSS via MIME sniffing.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs directory.

Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The problem is caused by an improperly restricted exec call in the virtualmin and sasl drivers of the password plugin.

CVE-2016-4069 in Roundcube Webmail before version 1.1.5 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack user authentication for requests that download attachments. This can lead to denial of service through unspecified vectors.

Roundcube Webmail before 1.6.18 and 1.7.3 is vulnerable to LDAP search filter injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.

Roundcube Webmail before 1.6.18 and 1.7.3 has an unclosed url() in a FuncIRI attribute of an SVG image that could evade remote image blocking, potentially leading to information disclosure or privilege escalation.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

Roundcube Webmail before 1.6.18 and 1.7.3 has improper HTML/CSS sanitization of the SVG animate "by" attribute that may lead to remote image blocking bypass, potentially resulting in information disclosure or privilege escalation.

In Roundcube Webmail before versions 1.6.17 and 1.7.x before 1.7.2, a stored Cross-Site Scripting (XSS) vulnerability exists via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click).

Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2 is vulnerable to Stored Cross-Site Scripting (XSS). The issue occurs because the attachment MIME type is not properly escaped on the attachment-validation warning page.

The password plugin in Roundcube Webmail before versions 1.6.17 and 1.7.2 was vulnerable to username spoofing via session data, which could lead to account takeover.

In Roundcube Webmail before versions 1.6.17 and 1.7.2, insufficient CSS sanitization in HTML email messages may lead to SSRF or information disclosure when stylesheet links point to local network hosts.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

In Roundcube Webmail before version 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was vulnerable to a denial of service (DoS) attack via a crafted compressed-RTF size.

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7 have insufficient HTML sanitization that could lead to CSS injection via an SVG document with an animate element using the attributeName attribute.

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 allow pre-authentication arbitrary file deletion via Redis/Memcache session poisoning.

Vulnerability in Roundcube Webmail versions 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1. Remote image blocking was not honored for URLs pointing to local/private destinations, potentially leading to information disclosure or privilege escalation via HTML email.

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 have insecure code evaluation logic in the LDAP autovalues option that could lead to code injection. Support for code evaluation has been removed in versions 1.6.16 and 1.7.1.

Roundcube Webmail versions 1.6.x between 1.6.14 and 1.6.16, and 1.7.x before 1.7.1 have insufficient CSS sanitization in HTML emails, which may lead to SSRF or information disclosure if stylesheet links point to local network hosts. The issue stems from an incomplete fix for CVE-2026-35540.

Roundcube Webmail versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1 contain a pre-authentication SQL injection vulnerability in the virtuser_query plugin. The vulnerability is due to a backslash escape bypass in preg_replace().

In Roundcube Webmail before versions 1.5.15 and 1.6.15, the remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, insufficient CSS sanitization in HTML messages was found. This allows bypassing fixed-position mitigation via the !important directive.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via SVG content with animate attributes in an email message. This may lead to information disclosure or access-control bypass.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an email message. This may lead to information disclosure or access-control bypass.

Roundcube Webmail before versions 1.5.14 and 1.6.14 has incorrect password comparison in the password plugin, leading to type confusion that allows password change without knowing the old password.

In Roundcube Webmail from version 1.6.0 to 1.6.14, insufficient CSS sanitization in HTML emails may lead to SSRF or information disclosure, e.g., when stylesheet links point to local network hosts.

An XSS vulnerability was found in Roundcube Webmail before versions 1.5.14 and 1.6.14 due to insufficient sanitization of HTML attachments in preview mode. The victim must preview a text/html attachment.

An issue was discovered in Roundcube Webmail before versions 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Roundcube Webmail before versions 1.5.14 and 1.6.14 has an unsafe deserialization vulnerability in the redis/memcache session handler, which can lead to arbitrary file write operations by unauthenticated attackers.