Roundcube Webmail Injection and Auth Flaws

Mail header injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows any authenticated mailbox user to inject arbitrary MIME part headers into an outgoing message by placing CRLF sequences in the media type of an inline-image data URI, rated CVSS 8.5 with high integrity impact and changed scope. The flaw sits in rcmail_sendmail::extract_inline_images(), which used the attacker-controlled media type without validation; exploitation needs the standard HTML compose feature and no victim interaction, but it is not available to unauthenticated remote attackers. The vendor has released fixed versions, and there is no public exploit identified at time of analysis.

Password changes in Roundcube Webmail can be applied to the wrong mailbox when the password plugin uses the Modoboa driver, affecting releases before 1.6.20 and 1.7.x before 1.7.5. An authenticated Roundcube user can trigger this over the network, but exploitation is conditional on the Modoboa API account search returning another account first, so it is opportunistic rather than reliable. No public exploit was identified at time of analysis; vendor patches are available in 1.6.20 and 1.7.5.

Path traversal in the squirrelmail_usercopy migration plugin of Roundcube Webmail allows an authenticated low-privilege user to read files outside the configured SquirrelMail data directory and have their contents imported into their own account. Only deployments prior to 1.6.20, and 1.7.x prior to 1.7.5, that have the plugin enabled with squirrelmail_driver set to 'file' and a populated squirrelmail_data_dir are affected; the disclosure is read-only (confidentiality impact only, no integrity or availability loss) and requires the attacker to control a login name containing a slash. No public exploit code has been identified at time of analysis, and the weakness is confined to a non-default SquirrelMail-migration component rarely deployed in production, so this is a medium-severity (CVSS 5.3) information-disclosure issue rather than a high-priority emergency.

Cross-site scripting in the optional password plugin of Roundcube Webmail (before 1.6.20, and 1.7.x before 1.7.5) allows a hostile or compromised password backend - the advisory names the DirectAdmin API - to inject script into the webmail interface by returning crafted error text during a password-change attempt. The driver's message was concatenated into the user-facing error string without HTML escaping, so the payload executes in the victim's Roundcube session and can read or act on mail content within that origin (scope change). Exploitation requires the password plugin to be enabled and a victim to actually submit a password change (UI:R), which limits mass abuse; the CVSS vector rates it 4.7 with PR:N but high attack complexity, and no public exploit code or CISA KEV listing was identified at time of analysis. Vendor-released patches exist in 1.6.20 and 1.7.5.

Mail header injection in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 lets a remote attacker inject arbitrary MIME part headers into an outgoing message when a victim forwards a crafted email as an attachment, because the received subject is reused verbatim as the generated attachment name without neutralizing CRLF sequences. Exploitation is not automatic: it requires the victim to receive the crafted message and then invoke the 'forward as attachment' compose action, and the assessed impact is limited to low integrity with no confidentiality or availability loss and no code execution (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N). Fixes are available in Roundcube 1.6.20 and 1.7.5; no public exploit was identified at time of analysis.