Medium WID-SEC-2026-2207 6 CVEs

Roundcube: Mehrere Schwachstellen

Published Jul 5, 2026 · Updated Nov 1, 2026 · Revision 11 · de-DE

Vendor: cPanel Vendor: Debian Vendor: Fedora Vendor: SUSE Product: cPanel/WHM Product: Linux Product: Linux Product: openSUSE Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in Roundcube ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Denial-of-Service-Angriffe zu verursachen, Cross-Site-Scripting-Angriffe durchzuführen sowie Daten zu manipulieren oder offenzulegen.

Product

Roundcube ist ein Open-Source Webmailsystem, basierend auf PHP.

Vulnerabilities 6

High 7.2

CVE-2026-54433 Public exploit

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted pla…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
High 7.2

CVE-2026-62643

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HT…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
Medium 6.4

CVE-2026-62644

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to …

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
Medium 4.7

CVE-2026-54432

Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS). The issue occurs becau…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
Medium 4.3

CVE-2026-62641

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a craf…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
Medium 4.3

CVE-2026-62642

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which m…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026

Revision history

2026-11-01 #11
Neue Updates von openSUSE aufgenommen
2026-10-29 #10
Neue Updates von openSUSE aufgenommen
2026-10-05 #9
Neue Updates von Debian aufgenommen
2026-08-30 #8
Neue Updates von Debian aufgenommen
2026-08-05 #7
Neue Updates aufgenommen
2026-07-27 #6
Neue Updates aufgenommen
2026-07-21 #5
Neue Updates von Debian aufgenommen
2026-07-19 #4
Neue Updates von Debian aufgenommen
2026-07-14 #3
CVE aufgenommen
2026-07-06 #2
Neue Updates von Fedora aufgenommen
2026-07-05 #1
Initiale Fassung

References

Roundcube Security update vom 2026-07-05
https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
Rondcube Release Notes vom 2026-07-05
https://github.com/roundcube/roundcubemail/releases/tag/1.6.17
Rondcube Release Notes vom 2026-07-05
https://github.com/roundcube/roundcubemail/releases/tag/1.7.2
Fedora Security Advisory FEDORA-2026-C3351F4AE4 vom 2026-07-07
https://bodhi.fedoraproject.org/updates/FEDORA-2026-c3351f4ae4
Fedora Security Advisory FEDORA-EPEL-2026-A54F17ADC3 vom 2026-07-07
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-a54f17adc3
Fedora Security Advisory FEDORA-EPEL-2026-44B1DD565D vom 2026-07-07
https://bodhi.fedoraproject.org/updates/FEDORA-EPEL-2026-44b1dd565d
Fedora Security Advisory FEDORA-2026-517DAA8D64 vom 2026-07-07
https://bodhi.fedoraproject.org/updates/FEDORA-2026-517daa8d64
cPanel 110 Changelog vom 2026-07-15
https://docs.cpanel.net/changelogs/110-change-log/
cPanel 136 Change Log vom 2026-07-15
https://docs.cpanel.net/changelogs/136-change-log/
cPanel 134 Change Log vom 2026-07-15
https://docs.cpanel.net/changelogs/134-change-log/
Debian Security Advisory DSA-6391 vom 2026-07-19
https://security-tracker.debian.org/tracker/DSA-6391-1
Debian Security Advisory DLA-4693 vom 2026-07-22
https://lists.debian.org/debian-lts-announce/2026/07/msg00035.html
cPanel & WHM Change Log vom 2026-07-27
https://docs.cpanel.net/changelogs/138-change-log/
cPanel & WHM Change Log
https://docs.cpanel.net/changelogs/110-change-log/
Debian Security Advisory DLA-4760 vom 2026-08-29
https://lists.debian.org/debian-lts-announce/2026/08/msg00051.html
Debian Security Advisory DLA-4823 vom 2026-10-05
https://lists.debian.org/debian-lts-announce/2026/10/msg00015.html
openSUSE Security Update OPENSUSE-SU-2026:0361-1 vom 2026-10-29
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TIHQXAVDKF5E53CSRZASN2PMF3CXEORP/
openSUSE Security Update OPENSUSE-SU-2026:12169-1 vom 2026-10-30
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OPRYR7NQAXW2AA2X6PU2GM76EV2F6BCV/
openSUSE Security Update OPENSUSE-SU-2026:22195-1 vom 2026-10-31
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/J3EVNRCCEZEFVA24W2SWDKEIJHRKIQ5Q/