Roundcube Webmail
97 CVEs affecting Roundcube Webmail. Latest disclosed: 2026-07-14. Critical: 7, High: 19.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-49113 | Critical | 9.9 | 2025-06-02 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validat… |
CVE-2024-37385 | Critical | 9.8 | 2024-06-07 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists bec… |
CVE-2021-44026 | Critical | 9.8 | 2021-11-19 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. |
CVE-2020-12641 | Critical | 9.8 | 2020-05-04 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert… |
CVE-2020-12640 | Critical | 9.8 | 2020-05-04 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. |
CVE-2024-42009 | Critical | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a cra… |
CVE-2024-42008 | Critical | 9.3 | 2024-08-05 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and… |
CVE-2018-9846 | High | 8.8 | 2018-04-07 | In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" par… |
CVE-2017-8114 | High | 8.8 | 2017-04-29 | Roundcube Webmail allows arbitrary password resets by authenticated users. This affects versions before 1.0.11, 1.1.x before 1.1.9, and 1.2.x before 1.2.5. The… |
CVE-2015-2181 | High | 8.8 | 2017-01-30 | Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers to have unspecified impact via the (1) p… |
CVE-2015-2180 | High | 8.8 | 2017-01-30 | The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the passwo… |
CVE-2016-4069 | High | 8.8 | 2016-08-25 | Cross-site request forgery (CSRF) vulnerability in Roundcube Webmail before 1.1.5 allows remote attackers to hijack the authentication of users for requests th… |
CVE-2026-48842 | High | 8.1 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash e… |
CVE-2017-16651 | High | 7.8 | 2017-11-09 | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including c… |
CVE-2026-48844 | High | 7.5 | 2026-05-25 | Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has insecure code evaluation logic in LDAP the autovalues option that could lead to code injection… |
CVE-2018-19205 | High | 7.5 | 2018-11-12 | Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue… |
CVE-2018-1000071 | High | 7.5 | 2018-03-13 | roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This at… |
CVE-2015-5383 | High | 7.5 | 2017-05-23 | Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the (1) config, (2) temp, or (3) logs director… |
CVE-2016-9920 | High | 7.5 | 2016-12-08 | steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the sendmail program is enabled, does not prope… |
CVE-2019-15237 | High | 7.4 | 2019-08-20 | Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. |