EUVD-2026-60164
GHSA-q5rh-mmp4-ppgq
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network attack requiring only a valid user account (PR:L); cmd_learn configuration is a prerequisite condition, not an attack-time complexity factor, so AC:L applies once deployed in that configuration.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
4DescriptionCVE.org
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.
AnalysisAI
Remote code execution in Roundcube Webmail (before 1.6.18 and 1.7.x before 1.7.3) is achievable by authenticated remote attackers through the cmd_learn driver of the markasjunk plugin, which passes unsanitized placeholder replacement values derived from user-controlled email content directly to OS command invocations (CWE-78). Exploitation is strictly limited to instances where the markasjunk plugin is installed and configured with the cmd_learn driver - a non-default, operator-configured setup - meaning the broader Roundcube population is unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) a valid authenticated Roundcube user account (CVSS PR:L - standard email login, no administrator rights required); (2) the markasjunk plugin must be installed and enabled on the target Roundcube instance; (3) the markasjunk plugin must be explicitly configured to use the cmd_learn driver specifically - not any other available driver. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H yields a score of 8.8, reflecting a network-reachable exploit requiring only a low-privilege authenticated session with no interaction from other users and full confidentiality, integrity, and availability impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with a valid Roundcube user account crafts or receives an email containing shell metacharacters in a field consumed as a cmd_learn placeholder replacement value, then marks the message as junk, causing the markasjunk plugin to invoke the cmd_learn driver; the unsanitized placeholder is expanded into the OS command string and interpreted by the shell, executing arbitrary commands under the web server process's privileges. No public proof-of-concept has been identified, but CWE-78 command injection is a well-understood and reliably exploitable class once the injection point and placeholder variable names are identified through source code review. |
| Remediation | The primary remediation is to upgrade to Roundcube Webmail 1.6.18 (for 1.6.x deployments) or 1.7.3 (for 1.7.x deployments), both confirmed as vendor-released patches per the official advisory at https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3 and GitHub release tags. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Roundcube Webmail installations to confirm which instances have the markasjunk plugin with cmd_learn driver configured. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
steps/mail/sendmail.inc in Roundcube before 1.1.7 and 1.2.x before 1.2.3, when no SMTP server is configured and the send
rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in
Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plu
The DBMail driver in the Password plugin in Roundcube before 1.1.0 allows remote attackers to execute arbitrary commands
A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to stea
Multiple buffer overflows in the DBMail driver in the Password plugin in Roundcube before 1.1.0 allow remote attackers t
Roundcube Webmail allows arbitrary password resets by authenticated users. Rated high severity (CVSS 8.8), this vulnerab
roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in e
An issue was discovered in Roundcube Webmail before 1.4.4. Rated medium severity (CVSS 6.5), this vulnerability is remot
Cross-site scripting (XSS) vulnerability in Roundcube Webmail before 1.2.0 allows remote attackers to inject arbitrary w
Cross-site scripting (XSS) vulnerability in program/include/rcmail.php in Roundcube before 1.0.6 and 1.1.x before 1.1.2
Same weakness CWE-78 – OS Command Injection
View allSame technique Command Injection
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today