Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
Published: 2026-10-22
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Unauthorized File Read
Action: Apply Patch
AI Analysis

Impact

Path traversal in the squirrelmail_usercopy plugin of Roundcube Webmail allows an attacker to read files outside the configured data directory when a login name contains a slash. The flaw is identified as CWE-22 and CWE-23 and can lead to disclosure of sensitive configuration files, private keys, or other confidential data, but does not provide execution capabilities.

Affected Systems

All installations of Roundcube Webmail older than version 1.6.20 or 1.7.x preceding 1.7.5 that have the squirrelmail_usercopy plugin enabled and use the file‑based backend are affected. The vulnerability is confined to environments where the plugin is active.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. The EPSS score of 0.00367 indicates a very low, but non‑zero, likelihood of exploitation, and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires the attacker to control the login name field of the authentication request, which is then processed by the plugin.

Generated by OpenCVE AI on October 29, 2026 at 14:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Roundcube to version 1.6.20 or later or 1.7.5 or newer to apply the official fix.
  • If an upgrade cannot be performed immediately, disable or remove the squirrelmail_usercopy plugin to prevent the path traversal mechanism from being exercised.
  • If the plugin must remain enabled, configure input validation to reject login names containing path separators or sanitise the input before it is used to construct file paths.

Generated by OpenCVE AI on October 29, 2026 at 14:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-6579-1 roundcube security update
History

Thu, 29 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
Title Path Traversal Vulnerability in Roundcube's squirrelmail_usercopy Plugin roundcubemail: roundcubemail: Information disclosure via path traversal in squirrelmail_usercopy plugin
Weaknesses CWE-22
References
Metrics threat_severity

None

 threat_severity

Moderate

Wed, 28 Oct 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 22 Oct 2026 07:45:00 +0000

Type Values Removed Values Added
Title Path Traversal Vulnerability in Roundcube's squirrelmail_usercopy Plugin

Thu, 22 Oct 2026 01:15:00 +0000

Type Values Removed Values Added
Description Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
First Time appeared Roundcube
Roundcube webmail
Weaknesses CWE-23
CPEs cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*
Vendors & Products Roundcube
Roundcube webmail
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Subscriptions

Roundcube Webmail
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-28T02:11:26.866Z

Reserved: 2026-10-22T01:08:34.177Z

Link: CVE-2026-114714

cve-icon Vulnrichment

Updated: 2026-10-28T02:11:22.828Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-22T01:16:58.717

Modified: 2026-10-28T03:17:10.827

Link: CVE-2026-114714

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-22T01:08:34Z

Links: CVE-2026-114714 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-29T14:15:07Z

Weaknesses
  • CWE-22

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE-23

    Relative Path Traversal