SB2026080905 - Multiple vulnerabilities in Roundcube Webmail
Published: August 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 11 vulnerabilities.
1) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access unintended internal resources.
The vulnerability exists due to improper input validation in the css proxy when processing proxied content. A remote attacker can supply crafted content references to access unintended internal resources.
2) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in the SSRF filter when handling specific local address URLs. A remote attacker can provide crafted URLs using 100.64.0.0/10 or fe80::/10 addresses to perform server-side request forgery.
3) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to perform server-side request forgery.
The vulnerability exists due to improper input validation in the is_local_url() check when handling nip.io and sslip.io hostnames. A remote attacker can use crafted hostname forms to perform server-side request forgery.
4) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote content blocking.
The vulnerability exists due to improper input validation in remote content blocking when processing a FuncIRI attribute. A remote attacker can use an unclosed url() value in a FuncIRI attribute to bypass remote content blocking.
5) LDAP injection (CVE-ID: N/A)
CWE-ID: CWE-90 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to manipulate LDAP queries.
The vulnerability exists due to LDAP injection in the search_filter when substituting unescaped %u, %fu, or %d values. A remote user can supply crafted substitution values to manipulate LDAP queries.
6) Improper access control (CVE-ID: N/A)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject arbitrary Sieve scripts.
The vulnerability exists due to improper access control in filter rule name handling when enforcing managesieve_disabled_actions. A remote user can use a crafted filter rule name to inject arbitrary Sieve scripts.
7) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to execute arbitrary code.
The vulnerability exists due to command injection in the cmd_learn driver of the markasjunk plugin when invoking the learning command. A remote user can supply crafted input to execute arbitrary code.
8) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject IMAP commands.
The vulnerability exists due to improper input validation in mail search handling when processing LITERAL+ byte counts. A remote user can send crafted search input to inject IMAP commands.
9) Information disclosure (CVE-ID: N/A)
CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor
CVSSv4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to disclose an authentication token to a user-controlled host.
The vulnerability exists due to exposure of sensitive information to an unauthorized actor in the modoboa driver when contacting a user-controlled host. A remote user can cause the password feature to contact a user-controlled host to disclose an authentication token.
10) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote attacker to execute arbitrary script in a user's browser.
The vulnerability exists due to cross-site scripting in the "Add to address book" action when storing attacker-controlled data. A remote attacker can submit crafted data that is later rendered to execute arbitrary script in a user's browser.
11) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass HTML and CSS sanitization.
The vulnerability exists due to improper input validation in the HTML/CSS sanitizer when processing the SVG animate by attribute. A remote attacker can supply crafted SVG content to bypass HTML and CSS sanitization.
User interaction is required to render the crafted content.
Remediation
Install update from vendor's website.