EUVD-2026-18579
GHSA-8jr8-v43g-5c57
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Argument sanitization
|
| Impact | The risk profile is moderate-to-low despite the CVSS score of 3.1 (Low severity). The CVSS vector shows AC:H (high attack complexity), indicating the attack is not trivial to execute; PR:L (low privilege required) means only authenticated users can exploit this, eliminating mass unauthenticated attack potential; and UI:N with S:U and I:L indicate limited integrity impact in a user context without system-wide compromise. The EPSS exploitation probability is not provided, but the high complexity and authentication requirement suggest real-world exploitation likelihood is constrained. No CISA KEV status is reported and no public exploit code is confirmed, further reducing immediate threat level. However, the CSRF bypass angle is concerning because it could allow account compromise in multi-user webmail environments if an attacker crafts a malicious link/email targeting a victim user. Organizations with Roundcube deployments should prioritize this as a medium-priority patch due to the CSRF vector rather than the raw CVSS score. |
| Exploit ScenarioDerived | An authenticated Roundcube user receives a phishing email containing a crafted link that, when clicked while logged into Roundcube, injects IMAP commands into a background mail search request. Alternatively, an attacker with legitimate Roundcube account access manually injects IMAP protocol sequences into the search form to manipulate mail retrieval or trigger unintended server-side behavior. In either case, the attack requires the victim to be authenticated and the attacker to understand IMAP protocol syntax; no automated exploit toolkit is known to exist. The high complexity threshold (AC:H) reflects this limitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 03, 2026
Roundcube Webmail before versions 1.5.14 and 1.6.14 allows authenticated remote attackers to conduct IMAP injection attacks or bypass CSRF protections via unsanitized IMAP SEARCH command arguments. The vulnerability requires user interaction (high complexity) and authenticated access, resulting in limited integrity impact without confidentiality or availability compromise. No public exploit code or active exploitation has been confirmed at time of analysis.
RemediationAI
Administrators must upgrade Roundcube Webmail to version 1.5.14 or later in the 1.5.x branch, or version 1.6.14 or later in the 1.6.x branch. Patched releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 and https://github.com/roundcube/roundcubemail/releases/tag/1.6.14. The upstream fixes are documented in commits 7daf5aa9c190ccc75bb31672d8fee9938877fd64 (1.5.x), b18a8fa8e81571914c0ff55d4e20edb459c6952c (1.6.x), and 5fe8a69956a9683a4269f3ad2a68e18deebf8a15 (1.7-rc5). No interim workarounds are documented; patching is the primary remediation path. Users should test patched versions in a staging environment before production deployment to ensure mail search functionality remains operational.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in composer, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube Webmail implements IMAP email search functionality by constructing IMAP SEARCH commands sent to backend mail servers. The vulnerability stems from insufficient sanitization of user-supplied search parameters before they are incorporated into IMAP protocol messages (CWE-88: Argument Injection). IMAP SEARCH commands use specific syntax with space and bracket delimiters; when user input is not properly escaped, attackers can inject arbitrary IMAP commands or protocol sequences. This also enables CSRF bypass because unsanitized parameters can be exploited in cross-site request scenarios where the user's authenticated session is leveraged without their knowledge. The affected product is Roundcube Webmail (cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*) across versions below 1.5.14 in the 1.5.x branch and versions 1.6.0 through 1.6.13 in the 1.6.x branch.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Primary rating from Vendor (mitre) · only source for this CVE.
CVSS VectorVendor: mitre
Lifecycle Timeline
2DescriptionCVE.org
An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Related Vulnerabilities in Roundcube Webmail Multiple Vulnerabilities
View all 8Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
Exploit-DB