EUVD-2026-60170
GHSA-3247-mrpv-cpmj
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Network-accessible web UI, low complexity once authenticated; PR:L because a valid user account is required; integrity impact limited to Sieve policy bypass with no confidentiality or availability consequence.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.
AnalysisAI
Sieve script injection in Roundcube Webmail's managesieve plugin allows authenticated users to bypass the administrator-configured managesieve_disabled_actions restriction by embedding unquoted special characters in a filter rule name. Affected branches are 1.6.x before 1.6.18 and 1.7.x before 1.7.3; instances without the managesieve plugin are not affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege Roundcube user account (confirmed by CVSS PR:L) and the target instance must have the managesieve plugin explicitly enabled in its configuration - the vulnerability has no effect on standard Roundcube deployments without the plugin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 4.3 (Medium) is consistent with the bounded impact: the attack vector is network (AV:N), complexity is low (AC:L), low-privilege authentication is required (PR:L), no user interaction is needed (UI:N), and the scope is unchanged (S:U) with only limited integrity impact (I:L) and no confidentiality or availability loss. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An authenticated Roundcube user navigates to the Filters section powered by the managesieve plugin and creates a new filter rule with a crafted name containing unescaped quote characters or other Sieve syntax delimiters. When the plugin generates the Sieve script and submits it to the ManageSieve server, the injected content is interpreted as additional Sieve script commands, causing prohibited actions - such as message redirection or vacation autoresponders restricted by the administrator - to execute on the user's incoming mail. … |
| Remediation | Upgrade to Roundcube Webmail 1.6.18 (1.6.x branch) or 1.7.3 (1.7.x branch); both tagged releases are available at https://github.com/roundcube/roundcubemail/releases/tag/1.6.18 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.3 respectively, and the vendor advisory is at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-77 – Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today