CVE-2026-114714: Path Traversal
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmailusercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmaildatadir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments using the squirrelmail_usercopy plugin with its file-based backend are exposed if they run Roundcube Webmail before 1.6.20 or a 1.7.x release before 1.7.5. Exploitation requires a logged-in user account whose login name contains a slash.
What can an attacker access through this issue?
An attacker may cause files outside the configured squirrelmail_data_dir to be read and imported. The provided severity vector indicates confidentiality impact only, with no stated integrity or availability impact.
What should be done if an update cannot be applied immediately?
Prevent login names containing slashes from being accepted or used while the squirrelmail_usercopy plugin uses the file-based backend. Updating to 1.6.20 or 1.7.5 addresses the unsafe path construction by rejecting such login names.