Roundcube Webmail 1.6.20 and 1.7.5 fix multiple flaws allowing RCE, SSRF, XSS and CSRF (CERT-FR CERTFR-2026-AVI-1340)
Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 03/11/2026 00:01; os links antigos trazem para cá.
CERT-FR advisory CERTFR-2026-AVI-1340, dated 19 October 2026, reports multiple vulnerabilities in Roundcube Webmail. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution, server-side request forgery (SSRF) and cross-site scripting (XSS). The impact list also includes CSRF and security policy bypass (cert.ssi.gouv.fr, cert.cyber.gouv.fr). The vendor released fixes on 19 October 2026 in versions 1.6.20 and 1.7.5. The advisory is based on the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5". Neither source mentions exploitation in the wild, IOCs or attribution. A later copy of the advisory (cert.cyber.gouv.fr) lists seven CVE identifiers.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1340 (19 October 2026) reports multiple vulnerabilities in Roundcube Webmail, tracked as CVE-2026-114715 to CVE-2026-114721. Per the advisory, some of them let an attacker achieve remote arbitrary code execution, server-side request forgery (SSRF) and indirect remote code injection (XSS). Security policy bypass and CSRF are also listed. The advisory does not map impacts to individual CVEs and gives no CVSS scores or prerequisites (authentication, configuration, user interaction). Affected: Roundcube Webmail 1.7.x before 1.7.5 and all versions before 1.6.20. Fixed in 1.7.5 and 1.6.20.
Como funciona
The articles do not describe how the vulnerable code paths work. The advisory only lists the impact classes (RCE, SSRF, XSS, CSRF, security policy bypass). It does not say which input or component reaches which step, or where processing goes wrong for each CVE.
Por que é vulnerável
The root causes are not given in the available sources. The advisory names only the resulting impact classes, and the details are in the vendor bulletin, which the articles do not reproduce. The fix ships in versions 1.6.20 and 1.7.5, but what it changes is not described.
Como foi descoberta
The articles do not say who found the flaws or how. CERT-FR's advisory is based on the Roundcube security bulletin 'security-updates-1.6.20-and-1.7.5' of 19 October 2026, published the same day. The first version of the advisory gave no CVE identifiers; a later copy lists seven. No exploitation in the wild is mentioned.
Explicação gerada por IA a partir da matéria e dos artigos, em 03/11/2026 00:16.
Detalhes técnicos
- Affected: Roundcube Webmail 1.7.x before 1.7.5, and all versions before 1.6.20 (cert.ssi.gouv.fr, cert.cyber.gouv.fr).
- Impacts listed: security policy bypass, remote arbitrary code execution, SSRF, XSS and CSRF. The later copy describes the XSS impact as indirect remote code injection (cert.cyber.gouv.fr).
- CVEs referenced: CVE-2026-114715, CVE-2026-114716, CVE-2026-114717, CVE-2026-114718, CVE-2026-114719, CVE-2026-114720, CVE-2026-114721 (cert.cyber.gouv.fr).
- The advisory does not map each impact to a specific CVE, and gives no attack vectors, CVSS scores or exploit information (cert.ssi.gouv.fr, cert.cyber.gouv.fr).
Remediação
- Upgrade to Roundcube Webmail 1.7.5 or 1.6.20, depending on the branch in use.
- Consult the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026 to obtain the vendor patches.
Relatos divergentes
- CVE identifiers: the earlier version of the advisory (cert.ssi.gouv.fr) states that no CVE identifiers are given. The later version (cert.cyber.gouv.fr, collected 2 November 2026) lists seven CVEs. The later source is the more current one on this point.
- Exploitation status: neither source reports active exploitation. This is an absence of mention, not confirmation that none occurred.
Linha do tempo
-
CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF and XSS; fixed in 1.6.20 and 1.7.5
ler a análise desta fonte ocultar
The French CERT-FR published advisory CERTFR-2026-AVI-1340 on 19 October 2026 on multiple vulnerabilities in Roundcube Webmail. According to the advisory, some of the flaws let an attacker achieve remote arbitrary code execution, server-side request forgery (SSRF) and indirect remote code injection (XSS). The advisory also lists security policy bypass and cross-site request forgery (CSRF) among the impacts. It is based on the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026. No exploitation in the wild is mentioned.
Technical Details
- Affected versions: Roundcube Webmail 1.7.x prior to 1.7.5, and versions prior to 1.6.20.
- CVEs referenced: CVE-2026-114715, CVE-2026-114716, CVE-2026-114717, CVE-2026-114718, CVE-2026-114719, CVE-2026-114720, CVE-2026-114721.
- The advisory does not provide per-CVE details, CVSS scores or exploit information.
Remediation
- Consult the Roundcube security bulletin (roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5) and apply the vendor patches.
- Upgrade to Roundcube Webmail 1.6.20 or 1.7.5 depending on the branch in use.
-
CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF, XSS and CSRF; fixed in 1.6.20 and 1.7.5
ler a análise desta fonte ocultar
CERT-FR advisory CERTFR-2026-AVI-1340 reports multiple vulnerabilities in Roundcube Webmail. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution, server-side request forgery (SSRF) and cross-site scripting (XSS). The advisory's impact list also includes CSRF and security policy bypass. Fixes were released by the vendor on 19 October 2026 in versions 1.6.20 and 1.7.5. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.
Technical Details
- Affected: Roundcube Webmail 1.7.x before 1.7.5 and all versions before 1.6.20.
- Impacts listed: security policy bypass, remote arbitrary code execution, SSRF, XSS and CSRF.
- The advisory does not map each impact to a specific flaw, nor does it give attack vectors, CVE IDs or CVSS scores.
Remediation
- Consult the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026 to obtain the patches.
- Upgrade to Roundcube Webmail 1.7.5 or 1.6.20, depending on the branch in use.