Product · Roundcube

Webmail

58 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

High 7.1

CVE-2026-113386 Public exploit

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated a…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Oct 20, 2026
High 7.2

CVE-2026-54433 Public exploit

In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted pla…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Jul 14, 2026
Medium 4.4

CVE-2026-48849 Public exploit

In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, an unsanitized subject field in the draft restored val…

Roundcube Webmail roundcube roundcube Debian Ubuntu

May 25, 2026
High 8.1

CVE-2026-48842 Public exploit

Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has Pre-authentication SQL injection in the virtuser_query…

Roundcube Webmail roundcube roundcube Debian Ubuntu

May 25, 2026
Medium 4.3

CVE-2026-25916 Public exploit

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

Roundcube Webmail roundcube roundcube Debian Ubuntu

Feb 9, 2026
High 7.2

CVE-2025-68461 Exploited Public exploit EPSS 27%

Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the an…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Dec 18, 2025
KEV Feb 20, 2026
Critical 9.9

CVE-2025-49113 Exploited Public exploit EPSS 100%

Roundcube Webmail Vulnerable to Authenticated RCE via PHP Object Deserialization

Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization.

Roundcube Webmail roundcube roundcube Debian Ubuntu Packagist

Jun 2, 2025
KEV Feb 20, 2026