EUVD-2026-31719
GHSA-vc2v-cxrw-6g4p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
AnalysisAI
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to bypass input sanitization through a preg_replace() backslash escape flaw and inject arbitrary SQL against the backing database. Versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 are affected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target must be a Roundcube Webmail 1.6.0-1.6.15 or 1.7.0 instance with the virtuser_query plugin enabled in config/config.inc.php (it is not in the default plugin set, so this is a meaningful limiter); the webmail login or address-lookup endpoint must be reachable by the attacker over the network. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | Signals diverge: CVSS 8.1 with AV:N/PR:N/UI:N and C:H/I:H/A:H reflects unauthenticated remote reach and full CIA impact, and SSVC labels technical impact as total - yet AC:H captures that the preg_replace bypass requires crafting a payload that successfully evades the escape logic, EPSS sits at 0.08% (23rd percentile), and SSVC exploitation status is 'none' with automatable 'no'. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a crafted email address containing a backslash sequence designed to evade the preg_replace() escape, targeting the login or virtuser_query lookup endpoint on an internet-facing Roundcube instance configured with the plugin. The malformed input breaks out of the quoted SQL context and executes attacker-controlled SQL - for example, dumping the users table to harvest password hashes for offline cracking or pivoting to mailbox takeover. … |
| Remediation | Upgrade to Roundcube Webmail 1.6.16 or 1.7.1 - vendor-released patches that contain the fix commits 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b (1.6.16) and 3406183a9976e36f992d3468f37d0e2346526ee9 (1.7.1), published in the security advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 and the release notes at https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Roundcube Webmail instances and identify those running versions 1.6.x prior to 1.6.16 or 1.7.x prior to 1.7.1; restrict network access to unpatched systems if immediate patching is not feasible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Vendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Share
External POC / Exploit Code
Leaving vuln.today