Roundcube · Roundcube Webmail
CVE-2017-16651
Roundcube Webmail File Disclosure Vulnerability
What it is
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CISA: Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: May 3, 2022
- Added to the CISA list
- November 3, 2021
- Published
- November 9, 2017
- Severity
- High 7.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 46% in the top 1.2% of all known vulnerabilities
- Weakness
- CWE-552
- More details
- NVD · CVE.org · CISA
All references (9)
- https://www.debian.org/security/2017/dsa-4030
- https://github.com/roundcube/roundcubemail/releases/tag/1.3.3
- https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
- https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html
- https://github.com/roundcube/roundcubemail/releases/tag/1.1.10
- http://www.securityfocus.com/bid/101793
- https://github.com/roundcube/roundcubemail/releases/tag/1.2.7
- https://github.com/roundcube/roundcubemail/issues/6026
- http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
More exploited flaws from Roundcube
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Jun 22, 2023 | Webmail Remote Code Execution | Roundcube Webmail | Critical 9.8 | 84% |
| Jun 22, 2023 | Webmail Cross-Site Scripting (XSS) | Roundcube Webmail | Medium 6.1 | 33% |
| Jun 22, 2023 | Webmail SQL Injection | Roundcube Webmail | Critical 9.8 | 70% |
| Feb 20, 2026 | Deserialization of Untrusted Data | Webmail | Critical 9.9 | 99.7% |
| Feb 20, 2026 | Cross-site Scripting | Webmail | High 7.2 | 27% |
| Jun 9, 2025 | Cross-Site Scripting | Webmail | Critical 9.3 | 83% |
| Oct 24, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.1 | 74% |
| Jun 26, 2024 | Cross-Site Scripting (XSS) | Webmail | Medium 6.3 | 77% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.