Roundcube vulnerabilities and fixes

CVEs that mention Roundcube, ranked by priority. 21 tracked.

Roundcube has 21 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 12. Most recent: 2026-10-22. Highest priority: CVE-2026-57517 (score 61/100).

• CVE-2026-57517 CRITICAL 9.8 Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r
• CVE-2026-113386 HIGH 7.1 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection
• CVE-2026-114720 HIGH 7.1 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability
• CVE-2026-114716 HIGH 8.5 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
• CVE-2026-114730 HIGH 7.2 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery fil
• CVE-2026-114727 HIGH 8.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when
• CVE-2026-114731 MEDIUM 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vul
• CVE-2026-114722 MEDIUM 6.5 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages
• CVE-2026-114726 MEDIUM 5.8 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in
• CVE-2026-114728 MEDIUM 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the
• CVE-2026-114729 MEDIUM 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
• CVE-2026-114732 MEDIUM 6.8 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability
• CVE-2026-114715 MEDIUM 6.8 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability
• CVE-2026-114724 HIGH 7.4 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session
• CVE-2026-114714 MEDIUM 5.3 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the sq
• CVE-2026-114717 MEDIUM 4.0 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability wh
• CVE-2026-114723 LOW 3.7 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed d
• CVE-2026-114725 MEDIUM 5.0 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
• CVE-2026-114719 LOW 3.7 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-
• CVE-2026-114718 MEDIUM 4.7 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in
• CVE-2026-114721 LOW 3.1 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be

FAQ

How do I fix Roundcube vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is Roundcube being exploited right now?

None of the tracked Roundcube CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.

Which Roundcube CVE should I patch first?

CVE-2026-57517 currently ranks highest (61/100): Control Web Panel before 0.9.8.1225 contains a blind SQL injection vulnerability that allows unauthenticated r.

← Back to latest CVEs