EUVD-2026-31719
GHSA-vc2v-cxrw-6g4p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify exposed Roundcube login endpoint
-
DeliveryConfirm virtuser_query plugin enabled
-
ExploitCraft backslash-escape preg_replace bypass payload
-
ExecutionSubmit malicious address to trigger SQL injection
-
PersistExfiltrate credential hashes or session data
-
ImpactAuthenticate to mailboxes or pivot into database
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Parameterized queries, prepared statements
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The target must be a Roundcube Webmail 1.6.0-1.6.15 or 1.7.0 instance with the virtuser_query plugin enabled in config/config.inc.php (it is not in the default plugin set, so this is a meaningful limiter); the webmail login or address-lookup endpoint must be reachable by the attacker over the network. No authentication and no user interaction are required (PR:N/UI:N). The CVSS AC:H rating reflects that the attacker must construct a payload that defeats the specific preg_replace() backslash-escape logic rather than a trivial single-quote injection, which raises the bar above a stock SQLi probe. |
| Impact | Signals diverge: CVSS 8.1 with AV:N/PR:N/UI:N and C:H/I:H/A:H reflects unauthenticated remote reach and full CIA impact, and SSVC labels technical impact as total - yet AC:H captures that the preg_replace bypass requires crafting a payload that successfully evades the escape logic, EPSS sits at 0.08% (23rd percentile), and SSVC exploitation status is 'none' with automatable 'no'. The vulnerability is not on CISA KEV and no public PoC has been identified at time of analysis. One important caveat: the virtuser_query plugin is not enabled in every Roundcube deployment, so real-world exposure is narrower than the CPE wildcard implies - sites that do enable it (common in multi-domain or virtual hosting setups) face genuine pre-auth database compromise risk and should treat this as priority patching, while sites without the plugin enabled face materially lower exposure. |
| Exploit ScenarioDerived | An unauthenticated attacker submits a crafted email address containing a backslash sequence designed to evade the preg_replace() escape, targeting the login or virtuser_query lookup endpoint on an internet-facing Roundcube instance configured with the plugin. The malformed input breaks out of the quoted SQL context and executes attacker-controlled SQL - for example, dumping the users table to harvest password hashes for offline cracking or pivoting to mailbox takeover. No public PoC has been identified, but the fix commits are public, enabling skilled attackers to reverse the patch and develop weaponized exploitation. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jun 08, 2026
Pre-authentication SQL injection in Roundcube Webmail's virtuser_query plugin allows unauthenticated remote attackers to bypass input sanitization through a preg_replace() backslash escape flaw and inject arbitrary SQL against the backing database. Versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1 are affected. Vendor patches are available, no public exploit identified at time of analysis, and EPSS is low (0.08%), but SSVC rates technical impact as total.
RemediationAI
Upgrade to Roundcube Webmail 1.6.16 or 1.7.1 - vendor-released patches that contain the fix commits 87124cc7136a48b5fa9d2b40dfead6e9dcaeaf4b (1.6.16) and 3406183a9976e36f992d3468f37d0e2346526ee9 (1.7.1), published in the security advisory at https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1 and the release notes at https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 and https://github.com/roundcube/roundcubemail/releases/tag/1.7.1. Where immediate upgrade is not feasible, disable the virtuser_query plugin in config/config.inc.php by removing it from the $config['plugins'] array - this fully removes the vulnerable code path but breaks any virtual-user address-to-mailbox mapping that depends on it, so sites relying on virtuser_query for multi-domain mail routing should use the database-backed virtuser_file alternative or accelerate the upgrade. Additional defense-in-depth includes restricting database user privileges granted to the Roundcube account to only the tables and operations it requires, and placing the webmail behind a WAF tuned to flag SQL metacharacters on login-related endpoints - noting that WAF rules may produce false positives on legitimate addresses containing special characters.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Roundcube Webmail is a widely deployed PHP-based browser webmail client. The virtuser_query plugin maps email addresses to mailbox accounts by issuing SQL queries against a configured database, with input intended to be neutralized via PHP's preg_replace(). The root cause is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): a backslash-escape bypass in the preg_replace() routine permits attacker-controlled input to break out of the intended quoting context, so untrusted address strings reach the SQL statement unsanitized. CPE cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* covers all Roundcube Webmail installations regardless of OS or distribution packaging.
Know when Roundcube gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
Lifecycle Timeline
1DescriptionCVE.org
Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query plugin via a preg_replace() backslash escape bypass.
Executive ViewAI
Roundcube Webmail deployments running versions 1.6.x (prior to 1.6.16) and 1.7.x (prior to 1.7.1) contain an unauthenticated SQL injection vulnerability that bypasses login controls and grants direct access to the backend database. Attackers can exploit this flaw without valid credentials, exposing user mailboxes and sensitive business data stored within the email system. Email being a primary business communication channel, this vulnerability poses an immediate threat to organizational data confidentiality and integrity.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
SQL injection exploits the way applications construct database queries by mixing user input directly into SQL statements.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary file
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
Same weakness CWE-89 – SQL Injection
View allVendor StatusVendor
SUSE
Severity: High| Product | Status |
|---|---|
| openSUSE Leap 16.0 | Fixed |
| openSUSE Tumbleweed | Fixed |
Exploit-DB