Vulnerabilidades do Roundcube Webmail

CVE-2026-48849 Média · 4.4 CWE-79 25/05/2026

Cross-site Scripting (XSS) em Roundcube Webmail

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored value could lead to stored XSS/HTML/CSS injection on shared mailboxes.

CVE-2026-48848 Alta · 7.2 CWE-79 25/05/2026

Cross-site Scripting (XSS) em Roundcube Webmail

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7 has insufficient HTML sanitization that could lead to Cascading Style Sheets (CSS) injection via an SVG document that has an animate element with the attributeName attribute.

CVE-2026-48847 Baixa · 3.7 CWE-669 25/05/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication arbitrary file deletion via redis/memcache session poisoning bypass.

CVE-2026-48846 Média · 6.5 CWE-669 25/05/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image blocking feature can be bypassed via a crafted CSS var() value in an e-mail message, which may lead to information disclosure or access-control bypass.

CVE-2026-48845 Média · 6.5 CWE-669 25/05/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image blocking was not honored for URLs pointing to local/private destinations, which may lead to information disclosure or privilege escalation via a text/html email message.

CVE-2026-48844 Alta · 7.5 CWE-670 25/05/2026

Always-Incorrect Control Flow Implementation em Roundcube Webmail

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection. (Support for code evaluation has been removed in 1.6.16 and 1.7.1.)

CVE-2026-48843 Alta · 7.2 CWE-918 25/05/2026

Server-Side Request Forgery (SSRF) em Roundcube Webmail

Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16,and 1.7.x before 1.7.1 has Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts. The issue stems from an insufficient fix for CVE-2026-35540.

CVE-2026-48842 Alta · 8.1 CWE-89 25/05/2026

SQL Injection em Roundcube Webmail

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.

CVE-2026-35545 Alta · 8.2 CWE-669 03/04/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

CVE-2026-35544 Média · 5.3 CWE-669 03/04/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.

CVE-2026-35543 Média · 5.3 CWE-669 03/04/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.

CVE-2026-35542 Média · 5.3 CWE-669 03/04/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.

CVE-2026-35541 Média · 4.2 CWE-843 03/04/2026

Type Confusion em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.

CVE-2026-35540 Média · 6.5 CWE-669 03/04/2026

Incorrect Resource Transfer Between Spheres em Roundcube Webmail

An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.

CVE-2026-35539 Média · 6.1 CWE-79 03/04/2026

Cross-site Scripting (XSS) em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

CVE-2026-35538 Baixa · 3.1 CWE-88 03/04/2026

Argument Injection em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

CVE-2026-35537 Alta · 7.5 CWE-502 03/04/2026

Deserialization of Untrusted Data em Roundcube Webmail

An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.

CVE-2026-26079 Média · 4.7 CWE-829 11/02/2026

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets…

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.

CVE-2026-25916 Média · 4.3 CWE-420 09/02/2026

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is…

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

CVE-2025-68461 Média · 6.1 KEV Alta · 62 Exploit público CWE-79 18/12/2025

RoundCube Webmail Cross-site Scripting Vulnerability

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

CVE-2025-68460 Alta · 7.5 CWE-116 18/12/2025

Improper Encoding or Escaping of Output em Roundcube Webmail

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

CVE-2025-49113 Alta · 8.8 KEV Urgente · 76 Exploit público CWE-502 02/06/2025

RoundCube Webmail Deserialization of Untrusted Data Vulnerability

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

CVE-2024-42009 Crítica · 9.3 KEV Urgente · 70 Exploit público CWE-79 05/08/2024

RoundCube Webmail Cross-Site Scripting Vulnerability

A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.

CVE-2024-37383 Média · 6.1 KEV Alta · 67 Exploit público CWE-79 07/06/2024

RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

CVE-2023-5631 Média · 5.4 KEV Alta · 53 CWE-79 18/10/2023

Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability

Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code.