Input validation error in Roundcube Webmail - #VU162699
Published: November 9, 2026
Vulnerability identifier: #VU162699
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to supply insufficiently validated IMAP host input, which may permit unintended server connections.
The vulnerability exists due to improper input validation in Roundcube Webmail's IMAP host handling when accepting a host value. A remote attacker can supply a crafted IMAP host value to bypass expected input constraints, potentially influencing the destination or interpretation of an IMAP connection.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.21, 1.7.6