Skip to content
OpenAdvisories
Critical 1 exploited CVE DLA-2840-1 2 CVEs

roundcube - security update

Published Dec 6, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 roundcube 1.2.3+dfsg.1-4+deb9u9

Vulnerabilities 2

  • Critical 9.8
    CVE-2021-44026 Exploited Public exploit EPSS 70%

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    roundcube roundcube Debian Ubuntu
    KEV Jun 22, 2023
  • Unscored —
    CVE-2021-44025

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when dis…

    roundcube roundcube Debian Ubuntu