SB2026110962 - Multiple vulnerabilities in Roundcube Webmail
Published: November 9, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 17 vulnerabilities.
1) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject unintended IMAP commands.
The vulnerability exists due to insufficient neutralization of carriage return and line feed characters in Roundcube Webmail's _uid parameter handling when constructing IMAP commands. A remote user can submit an _uid value containing CRLF characters to introduce additional commands into the IMAP exchange.
Exploitation requires messages_cache to be enabled.
2) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to supply insufficiently validated IMAP host input, which may permit unintended server connections.
The vulnerability exists due to improper input validation in Roundcube Webmail's IMAP host handling when accepting a host value. A remote attacker can supply a crafted IMAP host value to bypass expected input constraints, potentially influencing the destination or interpretation of an IMAP connection.
3) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause server-side requests to destinations intended to be blocked.
The vulnerability exists due to incomplete address validation in Roundcube Webmail's is_local_url() SSRF filter when evaluating 6to4 addresses in the 2002::/16 range. A remote attacker can supply a URL containing a crafted 6to4 address to bypass the filter and induce a server-side request to a restricted destination.
4) Infinite loop (CVE-ID: N/A)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through excessive CPU consumption.
The vulnerability exists due to an unbounded loop in Roundcube Webmail's rcube_session::unserialize() function when processing a negative length token. A remote attacker can supply serialized session data containing a negative length token to trigger a CPU-consuming loop and disrupt service.
5) Input validation error (CVE-ID: N/A)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause potentially unsafe attachment content to be processed by ImageMagick.
The vulnerability exists due to insufficient validation of attachment content in Roundcube Webmail's image type conversion handling when passing attachments to ImageMagick. A remote attacker can supply a crafted attachment for image conversion to expose the image processor to potentially unsafe input.
6) Cross-site request forgery (CVE-ID: N/A)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger unintended mail purge or expunge operations through another user's session.
The vulnerability exists due to insufficient cross-site request forgery validation in Roundcube Webmail's mail purge and expunge command handling when processing requests for these operations. A remote attacker can induce a signed-in user's browser to send a crafted cross-site request to perform unintended mail removal operations.
7) Improper Handling of Case Sensitivity (CVE-ID: N/A)
CWE-ID: CWE-178 - Improper Handling of Case Sensitivity
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to invoke actions prohibited by the disabled_actions setting.
The vulnerability exists due to inconsistent action-name normalization in Roundcube Webmail's disabled_actions enforcement when evaluating action names containing underscores instead of hyphens. A remote user can replace '-' with '_' in an action name to bypass the restriction and invoke a disabled action.
8) Cross-site request forgery (CVE-ID: N/A)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass cross-site request forgery validation and potentially perform unintended actions through another user's session.
The vulnerability exists due to incomplete cross-site request forgery validation in Roundcube Webmail's POST request handling when processing file-only submissions. A remote attacker can induce a signed-in user's browser to submit a crafted file-only POST request to bypass validation and potentially trigger an unintended action.
9) Server-Side Request Forgery (SSRF) (CVE-ID: N/A)
CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause server-side requests to destinations intended to be blocked.
The vulnerability exists due to incomplete destination validation in Roundcube Webmail's CSS proxy is_local_url() checks when processing URLs using nip.io or sslip.io hostnames. A remote attacker can supply a crafted URL using one of these domains to bypass the local-address filter and induce a server-side request to a restricted destination.
10) Open redirect (CVE-ID: N/A)
CWE-ID: CWE-601 - URL Redirection to Untrusted Site ('Open Redirect')
CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to redirect a browser to an untrusted destination.
The vulnerability exists due to insufficient validation of redirect destinations in Roundcube Webmail's attachment retrieval error recovery when handling an IMAP error. A remote attacker can exploit the error recovery redirect to direct a browser to an attacker-controlled destination.
11) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: N/A)
CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject unintended content into outbound HTTP requests.
The vulnerability exists due to insufficient neutralization of HTTP request syntax in Roundcube Webmail's spellcheck ATD backend when constructing spellcheck requests. A remote user can submit crafted spellcheck input to alter the HTTP request sent by the backend.
12) CRLF injection (CVE-ID: N/A)
CWE-ID: CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to inject unintended mail headers into a message disposition notification.
The vulnerability exists due to insufficient neutralization of header syntax in Roundcube Webmail's message disposition notification subject handling when constructing notification messages. A remote attacker can supply a crafted subject used in an MDN to insert unintended mail headers.
13) Protection mechanism failure (CVE-ID: N/A)
CWE-ID: CWE-693 - Protection Mechanism Failure
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass configured trusted-host restrictions during URL resolution.
The vulnerability exists due to failure to enforce the trusted host setting in Roundcube Webmail's resolve_url() function when resolving URLs. A remote attacker can supply untrusted host information to influence URL resolution outside the configured trust restrictions.
14) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject Sieve script instructions and alter mail-filter behavior.
The vulnerability exists due to insufficient neutralization of script syntax in Roundcube Webmail's Sieve set/include modifier handling when generating a Sieve script. A remote user can supply crafted set/include modifiers to introduce unintended Sieve instructions into the generated script.
15) Code Injection (CVE-ID: N/A)
CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to inject Sieve script instructions and alter mail-filter behavior.
The vulnerability exists due to insufficient neutralization of script syntax in Roundcube Webmail's Sieve rule operator handling when generating a Sieve script. A remote user can supply a crafted rule operator to introduce unintended Sieve instructions into the generated script.
16) Cross-site request forgery (CVE-ID: N/A)
CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)
CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger destructive mail-filter management actions through another user's session.
The vulnerability exists due to insufficient cross-site request forgery protection in Roundcube Webmail's managesieve component when handling destructive actions through GET requests. A remote attacker can induce a signed-in user's browser to issue a cross-site GET request to perform an unintended destructive action.
17) Insufficient verification of data authenticity (CVE-ID: N/A)
CWE-ID: CWE-345 - Insufficient Verification of Data Authenticity
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to introduce untrusted host or IP address information into a message's Received: header.
The vulnerability exists due to insufficient verification of hostname and forwarded IP information in Roundcube Webmail's Received: header generation when constructing mail headers. A remote user can supply untrusted hostname or forwarded IP information to misrepresent the message's recorded origin.
Remediation
Install update from vendor's website.