CVE-2017-16651VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability

Affects Roundcube Roundcube WebmailSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 45.7% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2017-16651 (opens in a new tab)

Description

CVE-2017-16651 is a file disclosure vulnerability in Roundcube Webmail caused by insufficient input validation related to file-based attachment plugins, which are enabled by default. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.

Summary

Roundcube Webmail contains a file disclosure vulnerability (CVE-2017-16651) due to insufficient input validation combined with the use of file-based attachment plugins enabled by default. This flaw allows unauthorized disclosure of files. The vulnerability is known to be exploited in the wild. No detailed version or patch information is available from the provided data.

Impact

The vulnerability enables attackers to disclose files on the server running Roundcube Webmail, potentially exposing sensitive information. Exploitation has been observed in the wild, indicating active threat. The exact scope and impact depend on the server environment and configuration.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is applied, consider disabling file-based attachment plugins if feasible and restrict access to sensitive files on the server.

Weaknesses

CWE-552Files or Directories Accessible to External Parties (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 08:56:17 UTC

Weaknesses

References

Related threats