CVE Intelligence

Roundcube Webmail vulnerabilities

🔔 Create alert RSS Version checker

Published CVEs affecting Roundcube Webmail: 31 record(s), with affected versions and fixes.
cpe:2.3:a:roundcube:webmail

CVE-2026-48849 Medium · 4.4 CWE-79 May 25, 2026
Cross-site Scripting (XSS) in Roundcube Webmail
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.
CVE-2026-48848 High · 7.2 CWE-79 May 25, 2026
Cross-site Scripting (XSS) in Roundcube Webmail
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.
CVE-2026-48847 Low · 3.7 CWE-669 May 25, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.
CVE-2026-48846 Medium · 6.5 CWE-669 May 25, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.
CVE-2026-48845 Medium · 6.5 CWE-669 May 25, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.
CVE-2026-48844 High · 7.5 CWE-670 May 25, 2026
Always-Incorrect Control Flow Implementation in Roundcube Webmail
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)
CVE-2026-48843 High · 7.2 CWE-918 May 25, 2026
Server-Side Request Forgery (SSRF) in Roundcube Webmail
Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.
CVE-2026-48842 High · 8.1 CWE-89 May 25, 2026
SQL Injection in Roundcube Webmail
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
CVE-2026-35545 High · 8.2 CWE-669 Apr 3, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.
CVE-2026-35544 Medium · 5.3 CWE-669 Apr 3, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
CVE-2026-35543 Medium · 5.3 CWE-669 Apr 3, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
CVE-2026-35542 Medium · 5.3 CWE-669 Apr 3, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
CVE-2026-35541 Medium · 4.2 CWE-843 Apr 3, 2026
Type Confusion in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
CVE-2026-35540 Medium · 6.5 CWE-669 Apr 3, 2026
Incorrect Resource Transfer Between Spheres in Roundcube Webmail
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
CVE-2026-35539 Medium · 6.1 CWE-79 Apr 3, 2026
Cross-site Scripting (XSS) in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
CVE-2026-35538 Low · 3.1 CWE-88 Apr 3, 2026
Argument Injection in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
CVE-2026-35537 High · 7.5 CWE-502 Apr 3, 2026
Deserialization of Untrusted Data in Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
CVE-2026-26079 Medium · 4.7 CWE-829 Feb 11, 2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets…
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
CVE-2026-25916 Medium · 4.3 CWE-420 Feb 9, 2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is…
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
CVE-2025-68461 Medium · 6.1 KEV High · 62 Public exploit CWE-79 Dec 18, 2025
RoundCube Webmail Cross-site Scripting Vulnerability
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-68460 High · 7.5 CWE-116 Dec 18, 2025
Improper Encoding or Escaping of Output in Roundcube Webmail
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
CVE-2025-49113 High · 8.8 KEV Urgent · 76 Public exploit CWE-502 Jun 2, 2025
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVE-2024-42009 Critical · 9.3 KEV Urgent · 70 Public exploit CWE-79 Aug 5, 2024
RoundCube Webmail Cross-Site Scripting Vulnerability
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVE-2024-37383 Medium · 6.1 KEV High · 67 Public exploit CWE-79 Jun 7, 2024
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-5631 Medium · 5.4 KEV High · 53 CWE-79 Oct 18, 2023
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.