Threat Intelligence Database

Multiple vulnerabilities have been identified in Roundcube Webmail, an open-source PHP-based webmail system. These issues affect versions prior to 1.6.18 and versions from 1.7.0 up to but not including 1.7.3. The vulnerabilities include CWE-78, indicating potential command injection risks. The severity is assessed as high. No explicit patch or remediation information is provided in the input data. No known exploits in the wild have been reported.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability in the managesieve plugin where improper quoting of rule names can allow bypassing the managesieve_disabled_actions setting via a crafted Sieve script rule name. This vulnerability has a moderate severity score and does not affect confidentiality or availability but impacts integrity. No official patch or remediation details are provided in the available data.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a stored cross-site scripting (XSS) vulnerability in the "Add to address book" feature. This vulnerability allows an attacker with limited privileges and user interaction to inject malicious scripts that can affect confidentiality and integrity but does not impact availability. The issue is identified as CVE-2026-74999 with a CVSS score of 5.4 (medium severity).

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 have insufficient sanitization of Cascading Style Sheets (CSS) in HTML email messages. This vulnerability may allow Server-Side Request Forgery (SSRF) or information disclosure if stylesheet links point to local network hosts. The issue stems from incomplete fixes of previous related vulnerabilities.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability in the modoboa driver of the password plugin that can leak a Modoboa API authentication token to a user-controlled host via crafted session data. This affects only instances using the password plugin with the modoboa driver. The vulnerability has a CVSS score of 6.4, indicating medium severity.

Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability in the LDAP search filter. This flaw allows injection via unescaped %u/%fu/%d substitutions, potentially leading to information disclosure or privilege escalation.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure or privilege escalation.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to information disclosure or privilege escalation.

CVE-2026-74998 is a high-severity cross-site scripting (XSS) vulnerability in Roundcube Webmail. It affects versions before 1.6.18 and 1.7.x before 1.7.3. The issue arises because responses from the CSS proxy were not properly validated, potentially allowing information disclosure or XSS attacks via MIME sniffing.