EUVD-2026-107695
GHSA-748m-7gjm-2xw3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with slash-bearing login name
-
ExploitTrigger SquirrelMail prefs import routine
-
ExecutionPath escapes squirrelmail_data_dir
-
ImpactRead/import arbitrary server files
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V5 - File Handling Relative path traversal prevention
|
| Exploitation Conditions | Exploitation requires all of: the squirrelmail_usercopy plugin enabled; squirrelmail_driver set to 'file'; a configured squirrelmail_data_dir; and an attacker able to supply a login name containing a path separator ('/'). Limiting factors: the plugin is a non-default SquirrelMail-migration component rarely deployed in production, exploitation requires at least low-privilege authentication (PR:L) via a controllable login name, the impact is read-only disclosure (no write/modify or DoS), and the pre-fix code path only exists before 1.6.20 / 1.7.5. |
| Impact | This is a medium-severity (CVSS 5.3) information-disclosure issue, not a high-priority emergency. The vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N shows network reach but three dampening factors: high attack complexity (AC:H), required low-privilege authentication (PR:L), and impact limited to confidentiality (C:H) with no integrity or availability effect. No EPSS probability, SSVC decision, KEV listing, or POC was provided in the input, so exploitation likelihood cannot be quantified - no public exploit identified at time of analysis. The AC:H and the description together confirm the real limiter: the flaw only reaches a system where the non-default squirrelmail_usercopy migration plugin is enabled with the file backend and a configured squirrelmail_data_dir, and where the attacker controls a login name. Net: a credible but narrow file-read bug that most Roundcube deployments are not exposed to because the vulnerable plugin is rarely enabled; prioritize patching only where SquirrelMail migration is in use. Note that AV:N is stated despite the exploit requiring an authenticated login name - verify your deployment's authentication/registration model before dismissing as internal-only. |
| Exploit ScenarioDerived | On a Roundcube server where the squirrelmail_usercopy plugin is enabled with the file-based backend, an attacker who can log in (or control the login name presented) uses a login name containing slashes so the prefs-import routine builds a source path that traverses outside the configured squirrelmail_data_dir, reading and importing arbitrary server-side files. The AC:H rating reflects the dependence on this specific plugin configuration. No public exploit was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 22, 2026
Path traversal in the squirrelmail_usercopy migration plugin of Roundcube Webmail allows an authenticated low-privilege user to read files outside the configured SquirrelMail data directory and have their contents imported into their own account. Only deployments prior to 1.6.20, and 1.7.x prior to 1.7.5, that have the plugin enabled with squirrelmail_driver set to 'file' and a populated squirrelmail_data_dir are affected; the disclosure is read-only (confidentiality impact only, no integrity or availability loss) and requires the attacker to control a login name containing a slash. No public exploit code has been identified at time of analysis, and the weakness is confined to a non-default SquirrelMail-migration component rarely deployed in production, so this is a medium-severity (CVSS 5.3) information-disclosure issue rather than a high-priority emergency.
RemediationAI
Vendor-released patch: upgrade to Roundcube Webmail 1.6.20 or 1.7.5 (or later), which introduce an explicit rejection of login names containing '/' in the file-based import path (commits 15fd175d154311ca7f59cf696c6cc39471611aa6 and dbdfcac498164bcacb7ce273b6341678dd70c166); see https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 and the corresponding release tags. If upgrading cannot be done immediately, the most effective compensating control is to disable the squirrelmail_usercopy plugin entirely in config/config.inc.php, which removes the vulnerable import routine at the cost of losing SquirrelMail preference migration; alternatively, switch squirrelmail_driver away from 'file' (for example to the SQL backend), which avoids the vulnerable path construction but requires the SquirrelMail data to already exist in a database. Deployments that must keep the file driver should additionally reject authentication attempts whose login name contains '/' or '..' before they reach Roundcube, noting that this may break legitimate usernames containing separators. Given the read-only impact and the low-privilege authentication prerequisite, patching can be scheduled rather than treated as an emergency, but any internet-facing instance with the plugin enabled should be inventoried and remediated promptly.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The squirrelmail_usercopy plugin is an optional Roundcube component that imports preferences from a legacy SquirrelMail installation at login time. In read_squirrel_prefs(), when squirrelmail_driver is 'file', the plugin builds a source path by concatenating the configured squirrelmail_data_dir with a per-user file derived from the login name ($uname), then reads and imports that file. The pre-fix code performed no validation on $uname, so a login name containing '/' (or '..' segments built from it) could traverse out of the intended directory and cause arbitrary readable files on the server to be imported into the attacker's Roundcube account, effectively turning the import routine into an arbitrary file-read primitive (CWE-23, relative path traversal). Commit 15fd175d154311ca7f59cf696c6cc39471611aa6 addresses the root cause by adding a strpos($uname, '/') === false guard to the file-backend branch, so requests whose login name contains a separator skip the import path entirely. The flaw is a classic unsanitized-path-construction pattern in PHP application code and is only reachable when the plugin's file driver is active; SQL-backed driver configurations never touch the vulnerable code path.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable import flow but gated by the non-default file-backend plugin config (AC:H) and an authenticated login name (PR:L); read-only file disclosure gives C:H, I:N, A:N.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Path traversal exploits occur when applications use user-controlled input to construct file system paths without proper validation.
Related Vulnerabilities in Roundcube Webmail Injection and Auth Flaws
View all 5Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB