SB2026070504 - Multiple vulnerabilities in Roundcube Webmail

Description

This security bulletin contains information about 6 vulnerabilities.

1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of crafted compressed-rtf size in the tnef (winmail.dat) decoder when parsing a tnef attachment. A remote attacker can send a specially crafted tnef file to cause a denial of service.

2) Infinite loop (CVE-ID: N/A)

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to an infinite loop in the tnef (winmail.dat) decoder when parsing a tnef attachment. A remote attacker can send a specially crafted tnef file to cause a denial of service.

3) Improper access control (CVE-ID: N/A)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a remote user to escalate privileges.

The vulnerability exists due to improper access control in the password plugin when using a session-injected username. A remote user can inject a username into the session to escalate privileges.

4) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to access internal network resources.

The vulnerability exists due to improper input validation in the ssrf protection for local address urls when handling user-supplied urls. A remote attacker can supply a crafted local address url to access internal network resources.

5) Cross-site scripting (CVE-ID: CVE-2026-54432)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green

The vulnerability allows a remote user to execute arbitrary script code in a user's browser.

The vulnerability exists due to cross-site scripting in the attachment-validation warning page when rendering an unescaped attachment mime type. A remote user can store a crafted attachment mime type to execute arbitrary script code in a user's browser.

6) Cross-site scripting (CVE-ID: CVE-2026-54433)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green

The vulnerability allows a remote attacker to execute arbitrary script code in a user's browser.

The vulnerability exists due to cross-site scripting in the plain-text rendering component when rendering plain-text content. A remote attacker can send a specially crafted email to execute arbitrary script code in a user's browser.

No user interaction is required beyond viewing the affected content.

Remediation

Install update from vendor's website.

References

• https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.17