MSRXVulnerabilities / Roundcube Webmail
Roundcube Webmail vulnerabilities
2 Roundcube Webmail flaws were confirmed exploited in the wild in the past 365 days. Patch these first.
| Added | Exploited vulnerability | Fix by |
|---|---|---|
| 2026-02-20 | CVE-2025-68461 Roundcube Webmail RoundCube Webmail Cross-site Scripting Vulnerability RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document. | 2026-03-13 |
| 2026-02-20 | CVE-2025-49113 Roundcube Webmail RoundCube Webmail Deserialization of Untrusted Data Vulnerability RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php. | 2026-03-13 |
Newest Roundcube Webmail CVEs
15 of 108 in NVD| 2026-10-22 | CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved | 6.8 |
| 2026-10-22 | CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, so a stylesheet URL referencing an attacker-controlled host co | 5.3 |
| 2026-10-22 | CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so UR | 7.2 |
| 2026-10-22 | CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remote content to be loaded without the user's consent, disclosing | 5.3 |
| 2026-10-22 | CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( o | 5.3 |
| 2026-10-22 | CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstr | 8.3 |
| 2026-10-22 | CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded | 5.8 |
| 2026-10-22 | CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject | 5.0 |
| 2026-10-22 | CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the i | 7.4 |
| 2026-10-22 | CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory check was applied only on Windows, so on other platforms a crafted image with large dimensions was processed by GD without any | 3.7 |
| 2026-10-22 | CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and | 6.5 |
| 2026-10-22 | CVE-2026-114721 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authenticated attacker could reach an action listed in disabled_actions by requesting it through its deprecated alias instead. Upstre | 3.1 |
| 2026-10-22 | CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP com | 7.1 |
| 2026-10-22 | CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data but passed it to rcmail::get_uids() without constraining the input mode, so values re-read inside that helper could be tak | 3.7 |
| 2026-10-22 | CVE-2026-114718 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API | 4.7 |
Keyword search in the US National Vulnerability Database, so it can include products that merely mention Roundcube Webmail.
Source: CISA Known Exploited Vulnerabilities catalog 2026.10.28 (live), refreshed every 12 hours.