IP-DB.com
Türkçe English Deutsch Español
Anmelden API-Schlüssel holen
4.7Mittel

CVE-2026-114718

Roundcube Webmail Veröffentlicht: (vor 22 Tagen)

Beschreibung

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the message presented to the user without HTML escaping, so a backend able to influence that text, such as the DirectAdmin API, could inject script into the Roundcube interface. Upstream fixed this in the commit “Fix XSS issue in handling of password driver error responses”, which escapes the driver message before display.

Schwachstellentyp (CWE): CWE-79

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

HerstellerProduktVersionen
Roundcube Webmail 1.6.0 – < 1.6.20, 1.7.0 – < 1.7.5

Referenzen und Patches

CPE-Treffer (NVD) (2)
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* ≥ 1.6.0 < 1.6.20
  • cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:* ≥ 1.7.0 < 1.7.5

Neue CVEs im selben Produkt — Roundcube Webmail

6.8Mittel
CVE-2026-114732
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::query() matched the address against identity records without qua…

5.3Mittel
CVE-2026-114731
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read into memory in full, with no size limit and no read timeout, s…

7.2Hoch
CVE-2026-114730
Roundcube Webmail

Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6052 NAT64 prefix 64:ff9b::/96, the RFC 8215 local-use NAT64 pr…

5.3Mittel
CVE-2026-114729
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, but not `by`; so markup such as in an HTML message caused remot…

5.3Mittel
CVE-2026-114728
Roundcube Webmail

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a pattern that enumerated only some of its escaped spellings, so valu…