Path traversal in Roundcube Webmail - #VU156156

Vulnerability details

The vulnerability allows a remote user to influence the file path used by the SquirrelMail import feature, potentially accessing files outside the intended import location.

The vulnerability exists due to unsafe incorporation of a login name into a file path in SquirrelMail import handling when locating an import file. A remote user can use a crafted login name to alter path resolution and potentially cause the importer to access an unintended file.

Affected software

Remediation

External References

• https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.20

Related Security Bulletins

• Multiple vulnerabilities in Roundcube Webmail