Back to advisories
HIGH CERTFR-2026-AVI-1340
Multiple vulnerabilities in Roundcube Webmail
Published 19/10/2026
Source : CERT-FR
Description
Multiple vulnerabilities have been discovered in Roundcube Webmail. Some of them allow an attacker to achieve remote arbitrary code execution, server-side request forgery (SSRF) and remote cross-site scripting (XSS).
Impacts
- Remote cross-site scripting (XSS)
- Cross-site request forgery (CSRF)
- Remote arbitrary code execution
- Server-side request forgery (SSRF)
- Security policy bypass
Solutions
Refer to the vendor's security bulletin to obtain the patches (see the Documentation section).
Affected Products (1)
Roundcube Webmail
Affected versions :
Roundcube Webmail versions 1.7.x antérieures à 1.7.5
Roundcube Webmail versions antérieures 1.6.20
Roundcube Webmail versions antérieures 1.6.20
Information
- Severity
- HIGH
- Risk Indicators
- ? Exploit in Wild ? PoC Public ✗ CISA KEV ✓ Patch Available ? Workaround
- Source
- CERT-FR CERTFR-2026-AVI-1340
- External Link
- View Source ↗
- Published
- 19/10/2026
- Officially Updated
- 19/10/2026
- Added to OpenVOC
- 19/10/2026 18:00
- Last updated
- 20/10/2026 21:39
Sign in to see whether your assets are affected and to receive group notifications.