CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF and XSS; fixed in 1.6.20 and 1.7.5
The French CERT-FR published advisory CERTFR-2026-AVI-1340 on 19 October 2026 on multiple vulnerabilities in Roundcube Webmail. According to the advisory, some of the flaws let an attacker achieve remote arbitrary code execution, server-side request forgery (SSRF) and indirect remote code injection (XSS). The advisory also lists security policy bypass and cross-site request forgery (CSRF) among the impacts. It is based on the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026. No exploitation in the wild is mentioned.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1340 (19 October 2026) reports multiple vulnerabilities in Roundcube Webmail, tracked as CVE-2026-114715 to CVE-2026-114721. Per the advisory, some let an attacker achieve remote arbitrary code execution, server-side request forgery (SSRF) and indirect remote code injection (XSS); security policy bypass and CSRF are also listed. The advisory gives no per-CVE details, CVSS scores, or attacker prerequisites (authentication, configuration, user interaction). Affected: Roundcube Webmail 1.7.x before 1.7.5 and all versions before 1.6.20. Fixed in 1.6.20 and 1.7.5.
Como funciona
The articles do not describe how the vulnerable code paths work. The advisory only lists the impact classes (RCE, SSRF, XSS, CSRF, security policy bypass) and does not say which input or component reaches which step, or where processing goes wrong for each CVE.
Por que é vulnerável
The root causes are not given in the available sources. The advisory names only the resulting impact classes, and the details are in the vendor bulletin, which the articles do not reproduce. The fix is shipped in versions 1.6.20 and 1.7.5, but what it changes is not described.
Como foi descoberta
The articles do not say who found the flaws or how. CERT-FR's advisory is based on the Roundcube security bulletin 'security-updates-1.6.20-and-1.7.5' of 19 October 2026, published the same day. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 02/11/2026 12:18.
Detalhes técnicos
- Affected versions: Roundcube Webmail 1.7.x prior to 1.7.5, and versions prior to 1.6.20.
- CVEs referenced: CVE-2026-114715, CVE-2026-114716, CVE-2026-114717, CVE-2026-114718, CVE-2026-114719, CVE-2026-114720, CVE-2026-114721.
- The advisory does not provide per-CVE details, CVSS scores or exploit information.
Remediação
- Consult the Roundcube security bulletin (roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5) and apply the vendor patches.
- Upgrade to Roundcube Webmail 1.6.20 or 1.7.5 depending on the branch in use.
Linha do tempo
-
CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF and XSS; fixed in 1.6.20 and 1.7.5
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1340 on 19 October 2026 on multiple vulnerabilities in Roundcube Webmail. According to the advisory, some of the flaws let an attacker achieve remote arbitrary code execution, server-side request forgery (SSRF) and indirect remote code injection (XSS). The advisory also lists security policy bypass and cross-site request forgery (CSRF) among the impacts. It is based on the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026. No exploitation in the wild is mentioned.
Technical Details
- Affected versions: Roundcube Webmail 1.7.x prior to 1.7.5, and versions prior to 1.6.20.
- CVEs referenced: CVE-2026-114715, CVE-2026-114716, CVE-2026-114717, CVE-2026-114718, CVE-2026-114719, CVE-2026-114720, CVE-2026-114721.
- The advisory does not provide per-CVE details, CVSS scores or exploit information.
Remediation
- Consult the Roundcube security bulletin (roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5) and apply the vendor patches.
- Upgrade to Roundcube Webmail 1.6.20 or 1.7.5 depending on the branch in use.