CVE-2026-35540 is a medium severity vulnerability in Roundcube Webmail versions before 1.6.14. It involves insufficient sanitization of CSS in HTML email messages, which may allow server-side request forgery (SSRF) or information disclosure if stylesheet links reference local network hosts. The vulnerability affects Roundcube Webmail 1.6.0 and has a CVSS score of 5.4. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2026-35539 is a medium severity cross-site scripting (XSS) vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. The issue arises from insufficient sanitization of HTML attachments in preview mode, allowing an attacker to execute script code if a victim previews a crafted text/html attachment. This vulnerability requires user interaction to exploit and impacts confidentiality and integrity but not availability.
CVE-2026-35538 is a vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments can lead to IMAP injection or CSRF bypass during mail search. The issue arises from improper neutralization of argument delimiters (CWE-88). The vulnerability has a low severity with a CVSS score of 3.1. No official patch or remediation level is currently confirmed from the vendor advisory. There are no known exploits in the wild at this time.
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated attackers via crafted session data.
CVE-2026-25916 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.13 and 1.6 before 1.6.13. When the 'Block remote images' feature is enabled, the application fails to block SVG feImage elements, allowing remote image content to be loaded. This unprotected alternate channel can be exploited to bypass privacy protections intended to prevent remote content loading, potentially leaking user information. The vulnerability does not impact integrity or availability and requires user interaction to trigger. No known exploits are currently reported in the wild.
RoundCube Webmail contains a cross-site scripting vulnerability. This vulnerability could allow a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php.
Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.
CVE-2020-13965 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows a remote attacker to manipulate data by sending a malicious XML attachment. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker
to load arbitrary JavaScript code.
Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
CVE-2021-44026 is a high severity SQL injection vulnerability in Roundcube Webmail that affects the search functionality. This vulnerability allows attackers to inject malicious SQL queries via the search or search_params parameters. It has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-12641 is a remote code execution vulnerability in Roundcube Webmail. It allows attackers to execute arbitrary code by injecting shell metacharacters into configuration settings related to im_convert_path or im_identify_path. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the available data.
CVE-2020-35730 is a cross-site scripting (XSS) vulnerability in Roundcube Webmail. It allows attackers to send plain text emails containing JavaScript in a link reference element, which is improperly handled by the linkref_addinindex function in rcube_string_replacer.php. This vulnerability has been exploited in the wild and is considered high severity.
CVE-2017-16651 is a file disclosure vulnerability in Roundcube Webmail caused by insufficient input validation related to file-based attachment plugins, which are enabled by default. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided.
