CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF, XSS and CSRF; fixed in 1.6.20 and 1.7.5
CERT-FR advisory CERTFR-2026-AVI-1340 reports multiple vulnerabilities in Roundcube Webmail. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution, server-side request forgery (SSRF) and cross-site scripting (XSS). The advisory's impact list also includes CSRF and security policy bypass. Fixes were released by the vendor on 19 October 2026 in versions 1.6.20 and 1.7.5. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.
Entenda a falha
A vulnerabilidade
CERT-FR advisory CERTFR-2026-AVI-1340 reports multiple vulnerabilities in Roundcube Webmail, with no CVE IDs or CVSS scores. Per the advisory, an attacker could achieve remote arbitrary code execution, SSRF and XSS, and the impact list also includes CSRF and security policy bypass. The advisory does not say what access, authentication or user interaction is needed, nor which impact belongs to which flaw. Affected: all versions before 1.6.20, and 1.7.x before 1.7.5. Fixed in 1.6.20 and 1.7.5, released on 19 October 2026.
Como funciona
The articles do not describe how the vulnerable code paths work. The advisory only lists the resulting impact classes and does not say which input or component reaches which flaw. Details would have to come from the vendor's security bulletin, which is not included in the sources.
Por que é vulnerável
The sources do not state the root causes. The impact classes listed (code execution, SSRF, XSS, CSRF, policy bypass) point to several separate weaknesses, but the advisory does not map them or explain what the fix changes. Upgrading to 1.6.20 or 1.7.5 is the remedy.
Como foi descoberta
The articles do not say who found the flaws or how. The vendor published a security bulletin, 'security-updates-1.6.20-and-1.7.5', on 19 October 2026, and CERT-FR issued its advisory the same day pointing to it for patches. The advisory does not mention active exploitation.
Explicação gerada por IA a partir da matéria e dos artigos, em 22/10/2026 13:20.
Detalhes técnicos
- Affected: Roundcube Webmail 1.7.x before 1.7.5 and all versions before 1.6.20.
- Impacts listed: security policy bypass, remote arbitrary code execution, SSRF, XSS and CSRF.
- The advisory does not map each impact to a specific flaw, nor does it give attack vectors, CVE IDs or CVSS scores.
Remediação
- Consult the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026 to obtain the patches.
- Upgrade to Roundcube Webmail 1.7.5 or 1.6.20, depending on the branch in use.
Linha do tempo
-
CERT-FR: Multiple Roundcube Webmail vulnerabilities allow RCE, SSRF, XSS and CSRF; fixed in 1.6.20 and 1.7.5
ler a análise desta fonte ocultar
CERT-FR advisory CERTFR-2026-AVI-1340 reports multiple vulnerabilities in Roundcube Webmail. According to the advisory, an attacker could exploit them to achieve remote arbitrary code execution, server-side request forgery (SSRF) and cross-site scripting (XSS). The advisory's impact list also includes CSRF and security policy bypass. Fixes were released by the vendor on 19 October 2026 in versions 1.6.20 and 1.7.5. The advisory does not mention active exploitation, CVE identifiers, IOCs or attribution.
Technical Details
- Affected: Roundcube Webmail 1.7.x before 1.7.5 and all versions before 1.6.20.
- Impacts listed: security policy bypass, remote arbitrary code execution, SSRF, XSS and CSRF.
- The advisory does not map each impact to a specific flaw, nor does it give attack vectors, CVE IDs or CVSS scores.
Remediation
- Consult the Roundcube security bulletin "security-updates-1.6.20-and-1.7.5" of 19 October 2026 to obtain the patches.
- Upgrade to Roundcube Webmail 1.7.5 or 1.6.20, depending on the branch in use.