Do Son 
Roundcube shipped two security updates this week. Also, versions 1.6.18 and 1.7.3 close eleven separate bugs. The worst Roundcube webmail RCE flaw sits in a spam-training plugin.
Why It Matters
Webmail sits at the center of many organizations’ email flow. So, a single RCE bug there can hand an attacker a foothold on the mail server itself. The SSRF issues let a hidden request reach internal services an admin never meant to expose. Together, these bugs turn Roundcube into a soft target for anyone probing a network from the outside.
How the Attacks Work
The Roundcube webmail RCE bug lives in the markasjunk plugin’s cmd_learn driver. Researcher nept1337 found that it can trigger code execution through that path. Separately, two SSRF filter bypass issues let requests slip past the is_local_url() check. One abuses reserved address ranges like 100.64.0.0/10. The other hides behind nip.io and sslip.io hostnames that resolve to local addresses. Other fixes close an LDAP filter injection bug and a Sieve script injection issue. Additional patches address IMAP command injection and stored XSS in the address book. In addition, multiple independent researchers reported these bugs, including Milan Hoppe and Zach Hanley of Horizon3.ai.
Affected Versions
The fixes apply to Roundcube 1.6.x before 1.6.18 and 1.7.x before 1.7.3. Still, Roundcube has not published how many installs remain unpatched. No source confirms active exploitation, and no public proof-of-concept exists for any of these bugs today.
Patch and Mitigation Steps
Roundcube posted full details in its security update announcement. Admins running 1.6.x should grab the 1.6.18 release from GitHub. Those on 1.7.x should pull 1.7.3 instead. Given this Roundcube webmail RCE risk, waiting to update leaves a mail server open to takeover.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
