Roundcube

Exploited now

CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.

• 7.2HighFeb 20, 2026Roundcube Webmail XSSCVE-2025-68461RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.Added to KEV Feb 20, 2026Exploited27% likelyExploit code
• 9.9CriticalFeb 20, 2026Roundcube Webmail DeserializationCVE-2025-49113RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.Added to KEV Feb 20, 2026Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 9.3CriticalAug 5, 2024Roundcube Webmail XSSCVE-2024-42009RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.Added to KEV Jun 9, 2025 · 308 days after publicationExploited83% likelyExploit codeNucleiDetection
• 6.1MediumJun 7, 2024Roundcube Webmail XSSCVE-2024-37383RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.Added to KEV Oct 24, 2024 · 139 days after publicationExploited74% likelyExploit codeExploit-DBDetection
• 6.3MediumJun 9, 2020Roundcube Webmail XSSCVE-2020-13965Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.Added to KEV Jun 26, 2024 · 1,478 days after publicationExploited77% likelyDetection
• 6.1MediumSep 22, 2023Roundcube Webmail XSSCVE-2023-43770Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.Added to KEV Feb 12, 2024 · 143 days after publicationExploited64% likelyDetection
• 6.1MediumOct 18, 2023Roundcube Webmail XSSCVE-2023-5631Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.Added to KEV Oct 26, 2023 · 7 days after publicationExploited76% likelyDetection
• 9.8CriticalNov 19, 2021Roundcube Webmail SQL injectionCVE-2021-44026Roundcube Webmail is vulnerable to SQL injection via search or search_params.Added to KEV Jun 22, 2023 · 580 days after publicationExploited70% likelyExploit code
• 9.8CriticalMay 4, 2020Roundcube Webmail Code / command injectionCVE-2020-12641Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.Added to KEV Jun 22, 2023 · 1,143 days after publicationExploited84% likelyExploit codeNucleiDetection
• 6.1MediumDec 28, 2020Roundcube Webmail XSSCVE-2020-35730Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.Added to KEV Jun 22, 2023 · 905 days after publicationExploited33% likelyExploit code
• 7.8HighNov 9, 2017Roundcube Webmail Path traversal / file handlingCVE-2017-16651Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.Added to KEV Nov 3, 2021 · 1,454 days after publicationExploited46% likelyExploit codeMetasploit

Recent

• –UnscoredOct 22, 2026RoundcubeADV-cccs-65b791ace01bSerial Number: AV26-1075 Date: October 22, 2026 As of October 19, 2026, Roundcube is affected by vulnerabilities in the following product: Roundcube Webmail Prior to 1.6.20 Prior to 1.7.5 The Cyber Centre encourages users and administrators to review the provided web links and apply any necessary updates as they become available. Security updates 1.6.20 and 1.7.5 released Roundcube Open Source Webmail Software
• 6.8MediumOct 22, 2026Roundcube Webmail Auth bypass / access controlCVE-2026-114732Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qualifying the lookup by IMAP host, so a login could be resolved to a user account belonging to a different IMAP host. Upstream fixed this in the commit “Fix bug where an alias login wasn’t qualified by IMAP host”.
• 7.2HighOct 22, 2026Roundcube Webmail SSRFCVE-2026-114730Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 prefix 64:ff9b:1::/48 and the unspecified address ::/128, so URLs such as http://[64:ff9b::7f00:1]/ passed the filter and reached loopback, link-local and cloud metadata addresses. Upstream fixed this in the commit “Fix SSRF filter (is_local_u
• 5.3MediumOct 22, 2026Roundcube webmailCVE-2026-114728Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so values using other CSS escape sequences, for example \000075rl( or u\72 l(, were not recognized and remote content was loaded from an HTML message without the user's consent. Upstream fixed this in the commit “Fix remote content blocking bypass
• 8.3HighOct 22, 2026Roundcube webmailCVE-2026-114727Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo upload and conversion, and both formats can reference external resources and invoke ImageMagick delegates when processed. Upstream fixed this in the commit “Fix passing potentally unsafe attachment content into ImageMagick on image resize”, which removes svg and eps from the accepted types.
• 5.8MediumOct 22, 2026Roundcube WebmailCVE-2026-114726Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the
• 5.0MediumOct 22, 2026Roundcube webmailCVE-2026-114725Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via Referen
• 7.4HighOct 22, 2026Roundcube webmail DeserializationCVE-2026-114724Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the input so that following session data was interpreted as a serialized value. This yields a PHP object injection primitive for an attacker able to influence stored session data. Upstr
• 6.5MediumOct 22, 2026Roundcube WebmailCVE-2026-114722Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a selector boundary, and did not handle selectors beginning with ::, so selectors following an at-rule were left unscoped and applied to the whole Roundcube interface instead of being confined to the message body. This allows an HTML message to restyle application chrome for UI redressing and spoofing. Up
• 4.7MediumOct 22, 2026Roundcube Webmail XSSCVE-2026-114718Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver messa
• 8.5HighOct 22, 2026Roundcube WebmailCVE-2026-114716Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates t
• 5.3MediumOct 22, 2026Roundcube Webmail Path traversal / file handlingCVE-2026-114714Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names co
• 9.9CriticalFeb 20, 2026Roundcube Webmail DeserializationCVE-2025-49113RoundCube Webmail contains a deserialization of untrusted data vulnerability that allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php.Exploited99% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
• 7.2HighFeb 20, 2026Roundcube Webmail XSSCVE-2025-68461RoundCube Webmail contains a cross-site scripting vulnerability via the animate tag in an SVG document.Exploited27% likelyExploit code
• 9.3CriticalAug 5, 2024Roundcube Webmail XSSCVE-2024-42009RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.Exploited83% likelyExploit codeNucleiDetection
• 6.1MediumJun 7, 2024Roundcube Webmail XSSCVE-2024-37383RoundCube Webmail contains a cross-site scripting (XSS) vulnerability in the handling of SVG animate attributes that allows a remote attacker to run malicious JavaScript code.Exploited74% likelyExploit codeExploit-DBDetection
• 6.3MediumJun 9, 2020Roundcube Webmail XSSCVE-2020-13965Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows a remote attacker to manipulate data via a malicious XML attachment.Exploited77% likelyDetection
• 6.1MediumSep 22, 2023Roundcube Webmail XSSCVE-2023-43770Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that can lead to information disclosure via malicious link references in plain/text messages.Exploited64% likelyDetection
• 6.1MediumOct 18, 2023Roundcube Webmail XSSCVE-2023-5631Roundcube Webmail contains a persistent cross-site scripting (XSS) vulnerability that allows a remote attacker to run malicious JavaScript code.Exploited76% likelyDetection
• 6.1MediumDec 28, 2020Roundcube Webmail XSSCVE-2020-35730Roundcube Webmail contains a cross-site scripting (XSS) vulnerability that allows an attacker to send a plain text e-mail message with Javascript in a link reference element that is mishandled by linkref_addinindex in rcube_string_replacer.php.Exploited33% likelyExploit code
• 9.8CriticalMay 4, 2020Roundcube Webmail Code / command injectionCVE-2020-12641Roundcube Webmail contains an remote code execution vulnerability that allows attackers to execute code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.Exploited84% likelyExploit codeNucleiDetection
• 9.8CriticalNov 19, 2021Roundcube Webmail SQL injectionCVE-2021-44026Roundcube Webmail is vulnerable to SQL injection via search or search_params.Exploited70% likelyExploit code
• 7.8HighNov 9, 2017Roundcube Webmail Path traversal / file handlingCVE-2017-16651Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.Exploited46% likelyExploit codeMetasploit

See every Roundcube entry on the dashboard.

Top products

• Webmail13 CVEs in the last year, 1 critical, 2 exploited

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• CCCS (Canada) · Oct 22, 2026Roundcube security advisory (AV26-1075)ADV-cccs-65b791ace01b