Vulnerabilidades de Roundcube
CVEs publicadas que afetam produtos de Roundcube: 47 registro(s), com severidade, exploração e correções.
CVE-2026-35544
Média · 5.3
CWE-669 03/04/2026
Incorrect Resource Transfer Between Spheres em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass via the use of !important.
CVE-2026-35543
Média · 5.3
CWE-669 03/04/2026
Incorrect Resource Transfer Between Spheres em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lead to information disclosure or access-control bypass.
CVE-2026-35542
Média · 5.3
CWE-669 03/04/2026
Incorrect Resource Transfer Between Spheres em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. This may lead to information disclosure or access-control bypass.
CVE-2026-35541
Média · 4.2
CWE-843 03/04/2026
Type Confusion em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowing the old password.
CVE-2026-35540
Média · 6.5
CWE-669 03/04/2026
Incorrect Resource Transfer Between Spheres em Roundcube Webmail
An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if stylesheet links point to local network hosts.
CVE-2026-35539
Média · 6.1
CWE-79 03/04/2026
Cross-site Scripting (XSS) em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
CVE-2026-35538
Baixa · 3.1
CWE-88 03/04/2026
Argument Injection em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
CVE-2026-35537
Alta · 7.5
CWE-502 03/04/2026
Deserialization of Untrusted Data em Roundcube Webmail
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
CVE-2026-26079
Média · 4.7
CWE-829 11/02/2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets…
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comments are mishandled.
CVE-2026-25916
Média · 4.3
CWE-420 09/02/2026
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is…
Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.
CVE-2025-68461
Média · 6.1
KEV Alta · 62 Exploit público CWE-79 18/12/2025
RoundCube Webmail Cross-site Scripting Vulnerability
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
CVE-2025-68460
Alta · 7.5
CWE-116 18/12/2025
Improper Encoding or Escaping of Output em Roundcube Webmail
Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
CVE-2025-49113
Alta · 8.8
KEV Urgente · 76 Exploit público CWE-502 02/06/2025
RoundCube Webmail Deserialization of Untrusted Data Vulnerability
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVE-2024-42009
Crítica · 9.3
KEV Urgente · 70 Exploit público CWE-79 05/08/2024
RoundCube Webmail Cross-Site Scripting Vulnerability
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
CVE-2024-37383
Média · 6.1
KEV Alta · 67 Exploit público CWE-79 07/06/2024
RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability
Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
CVE-2023-5631
Média · 5.4
KEV Alta · 53 CWE-79 18/10/2023
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
CVE-2023-43770
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 22/09/2023
Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
CVE-2021-44026
Crítica · 9.8
KEV Alta · 69 Exploit público CWE-89 19/11/2021
Roundcube Webmail SQL Injection Vulnerability
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
CVE-2020-35730
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 28/12/2020
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference element that is mishandled by linkref_addindex in rcube_string_replacer.php.
CVE-2020-13965
Média · 6.1
KEV Alta · 59 Exploit público CWE-79 09/06/2020
Roundcube Webmail Cross-Site Scripting (XSS) Vulnerability
An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
CVE-2020-12641
Crítica · 9.8
KEV Urgente · 73 Exploit público CWE-78 04/05/2020
Roundcube Webmail Remote Code Execution Vulnerability
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
CVE-2017-16651
Alta · 7.8
KEV Alta · 68 Exploit público CWE-552 09/11/2017
Roundcube Webmail File Disclosure Vulnerability
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.