Threat Intelligence Database

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 are vulnerable to remote code execution via the cmd_learn driver of the markasjunk plugin. This vulnerability arises from crafted placeholder replacement values and affects only instances using this specific plugin driver. The vulnerability has a high severity with a CVSS score of 8.8.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability in the managesieve plugin where improper quoting of rule names can allow bypassing the managesieve_disabled_actions setting via a crafted Sieve script rule name. This vulnerability has a moderate severity score and does not affect confidentiality or availability but impacts integrity. No official patch or remediation details are provided in the available data.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a stored cross-site scripting (XSS) vulnerability in the "Add to address book" feature. This vulnerability allows an attacker with limited privileges and user interaction to inject malicious scripts that can affect confidentiality and integrity but does not impact availability. The issue is identified as CVE-2026-74999 with a CVSS score of 5.4 (medium severity).

A vulnerability in Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 allows the modoboa driver of the password plugin to leak a Modoboa API authentication token. This leakage occurs via crafted session data and affects only Roundcube instances using the password plugin with the modoboa driver. The vulnerability has a CVSS score of 6.4, indicating a medium severity.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 have insufficient sanitization of Cascading Style Sheets (CSS) in HTML email messages. This vulnerability may allow Server-Side Request Forgery (SSRF) or information disclosure if stylesheet links point to local network hosts. The issue stems from incomplete fixes of previous related vulnerabilities.

CVE-2026-74998 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It affects versions before 1.6.18 and 1.7.x before 1.7.3. The issue arises because responses from the CSS proxy were not properly validated, potentially allowing information disclosure or XSS attacks via MIME sniffing.