SB2026101940 - Multiple vulnerabilities in Roundcube Webmail
Published: October 19, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 20 vulnerabilities.
1) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass image processing resource limits and potentially cause a denial of service.
The vulnerability exists due to inconsistent enforcement of resource limits in thumbnail generation when processing falls back from ImageMagick to GD. A remote attacker can supply image content that triggers the GD fallback to bypass ImageMagick resource limits and potentially exhaust server resources.
2) Path traversal (CVE-ID: N/A)
CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to influence the file path used by the SquirrelMail import feature, potentially accessing files outside the intended import location.
The vulnerability exists due to unsafe incorporation of a login name into a file path in SquirrelMail import handling when locating an import file. A remote user can use a crafted login name to alter path resolution and potentially cause the importer to access an unintended file.
3) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to change another account's password and potentially take over that account.
The vulnerability exists due to improper account authorization in the Password Modoboa driver when processing password changes. A remote user can cause a password change to target another account to modify its credentials without authorization.
4) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject mail headers through inline image content.
The vulnerability exists due to improper neutralization of header delimiters in inline image processing when incorporating the media type from a data URI into mail headers. A remote user can supply an inline image data URI with a crafted media type to introduce additional mail headers or alter header interpretation.
5) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject mail headers into a message forwarded as an attachment.
The vulnerability exists due to improper neutralization of header delimiters in attachment forwarding when processing the subject of the forwarded message. A remote attacker can supply a message with a crafted subject and induce a user to forward it as an attachment to introduce additional mail headers or alter header interpretation.
6) Cross-site scripting (CVE-ID: N/A)
CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]
The vulnerability allows a remote user to execute arbitrary script in a user's browser within the webmail application's origin.
The vulnerability exists due to improper neutralization of script-capable content in password driver error response handling when displaying an error. A remote user can introduce crafted content into a password driver error response to cause script execution when the response is rendered in a user's browser.
7) Cross-site request forgery (CVE-ID: N/A)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a user to perform an unintended mark-as-junk operation.
The vulnerability exists due to insufficient cross-site request forgery validation in the mark-as-junk action when handling requests in a user's session. A remote attacker can induce a user to submit a crafted cross-site request to bypass validation and mark messages as junk without the user's intent.
8) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject IMAP commands into mailbox operations.
The vulnerability exists due to improper neutralization of CRLF sequences in the _flag parameter of the mail/mark action when constructing IMAP commands. A remote user can submit a crafted _flag value containing carriage returns and line feeds to introduce additional IMAP commands that may perform unauthorized mailbox operations.
9) Incorrect authorization (CVE-ID: N/A)
CWE-ID: CWE-863 - Incorrect Authorization
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to invoke actions that an administrator has disabled.
The vulnerability exists due to incomplete authorization enforcement in action dispatch when processing deprecated action aliases. A remote user can request a disabled action through a deprecated alias to bypass the disabled_actions setting and execute the restricted action.
10) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to apply message-supplied CSS outside its intended scope and potentially manipulate the surrounding interface.
The vulnerability exists due to insufficient CSS scoping in HTML message rendering when processing CSS at-rules. A remote attacker can supply an HTML message containing crafted at-rules to escape the intended style boundary and affect the presentation of content outside the message.
11) Command injection (CVE-ID: N/A)
CWE-ID: CWE-77 - Command injection
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject IMAP commands into mailbox operations.
The vulnerability exists due to improper neutralization of CRLF sequences in the _uid parameter of the mail/headers and mail/viewsource actions when constructing IMAP commands. A remote user can supply a crafted _uid value containing carriage returns and line feeds to introduce additional IMAP commands that may perform unauthorized mailbox operations.
12) Deserialization of Untrusted Data (CVE-ID: N/A)
CWE-ID: CWE-502 - Deserialization of Untrusted Data
CVSSv4: 2.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject objects during session deserialization, potentially altering application behavior.
The vulnerability exists due to unsafe deserialization in rcube_session::unserialize() when handling session keys prefixed with an exclamation mark. A remote user can supply crafted session data using !-prefixed keys to introduce objects into the deserialization process and potentially affect subsequent application operations.
13) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject mail headers and alter outgoing message headers.
The vulnerability exists due to improper neutralization of header delimiters in mail header construction when processing References, In-Reply-To, Message-ID, or From parameters. A remote user can submit crafted values in these parameters to introduce additional headers or alter the interpretation of existing headers.
14) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject mail headers into messages processed by the Bounce action.
The vulnerability exists due to improper neutralization of header delimiters in the Bounce action when incorporating a message's From display-name into a resent message. A remote attacker can supply a message with a crafted From display-name and induce it to be resent to inject additional headers or alter message header interpretation.
15) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to subject the server's image processor to potentially unsafe attachment content, which may disrupt processing or compromise service availability.
The vulnerability exists due to insufficient restriction of attachment content passed to ImageMagick in image resizing when processing attachments. A remote attacker can supply a crafted attachment that reaches ImageMagick during resizing to expose the image processor to unsafe input and potentially disrupt service.
16) Protection mechanism failure (CVE-ID: N/A)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote content blocking and potentially disclose information through external content requests.
The vulnerability exists due to insufficient handling of CSS escape sequences in remote content filtering when processing FuncIRI attributes. A remote attacker can supply crafted FuncIRI attribute values containing CSS escapes to evade filtering and cause external content to load despite the blocking policy.
17) Protection mechanism failure (CVE-ID: N/A)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass remote content blocking and potentially disclose information through external content requests.
The vulnerability exists due to incomplete filtering of SVG SMIL attributes in remote content blocking when rendering content that uses the by attribute. A remote attacker can supply crafted SVG content using this attribute to trigger external content loading despite the blocking policy.
18) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to bypass server-side request forgery protections and potentially access restricted network destinations.
The vulnerability exists due to insufficient address validation in is_local_url() when evaluating destinations using the NAT64 64:ff9b::/96 prefix. A remote user can supply a URL using a NAT64 representation of an otherwise restricted IPv4 destination to bypass the filter and potentially cause server-side requests to that destination.
19) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause excessive resource consumption and potentially a denial of service.
The vulnerability exists due to a missing content size limit in CSS proxy processing when handling oversized CSS content. A remote attacker can provide excessive CSS content for the proxy to process to consume server resources and potentially disrupt service availability.
20) Improper Authentication (CVE-ID: N/A)
CWE-ID: CWE-287 - Improper Authentication
CVSSv4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause an alias login to be associated with an incorrect IMAP host context, potentially permitting unauthorized account access.
The vulnerability exists due to insufficient qualification of alias login identities in the login handling logic when resolving an alias against an IMAP host. A remote user can use an alias login whose host context is not properly distinguished to potentially cross an account identity boundary.
Remediation
Install update from vendor's website.