Roundcube Webmail (< 1.6.21) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/roundcube-webmail--1.6.21/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 10 Nov 2026 16:33:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRoundcube Webmail: Multiple vulnerabilitieshttps://feed.craftedsignal.io/briefs/2026-11-roundcube-vulnerabilities/Tue, 10 Nov 2026 16:33:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-roundcube-vulnerabilities/Multiple vulnerabilities in Roundcube Webmail versions 1.6.x and 1.7.x enable remote attackers to perform arbitrary code execution, SSRF, CSRF, and denial of service.Multiple vulnerabilities have been identified in Roundcube Webmail, affecting versions 1.6.x prior to 1.6.21 and 1.7.x prior to 1.7.6. These vulnerabilities can allow a remote attacker to achieve arbitrary code execution, conduct Server-Side Request Forgery (SSRF), perform Cross-Site Request Forgery (CSRF), and trigger denial-of-service conditions. Security updates have been released by the vendor.

Recommendation

  • Upgrade Roundcube Webmail to version 1.6.21 or 1.7.6 immediately to mitigate the identified security risks.
  • Review web server access logs for anomalous POST requests or unexpected outbound connections from the web server host, which may indicate attempted exploitation of SSRF or RCE vulnerabilities.
]]>highadvisory