CERT-FR: Multiple vulnerabilities in Roundcube software

CERT-FR Security Advisories

Published March 19th, 2026

Detected March 19th, 2026

Summary

CERT-FR has issued an advisory regarding multiple vulnerabilities discovered in Roundcube webmail software. The vulnerabilities could lead to data confidentiality breaches, server-side request forgery (SSRF), and remote code injection (XSS). Users are advised to consult the editor's security bulletin for patch information.

View original document View source feed page

What changed

CERT-FR, the French national cybersecurity agency, has published an advisory (CERTFR-2026-AVI-0320) detailing multiple critical vulnerabilities found in various versions of Roundcube webmail software. The identified risks include data confidentiality breaches, security policy bypass, server-side request forgery (SSRF), cross-site scripting (XSS), and cross-site request forgery (CSRF). Affected versions include 1.5.x prior to 1.5.14, 1.6.x prior to 1.6.14, and 1.7.x prior to 1.7-rc5.

Organizations using affected Roundcube versions must immediately consult the Roundcube security bulletin and apply the necessary patches to mitigate these risks. Failure to do so could result in significant data breaches and compromise the integrity of their systems. The advisory directs users to the editor's security updates for specific patch details and implementation guidance.

What to do next

Consult the Roundcube security bulletin for patch information.
Apply security updates to affected Roundcube versions (1.5.x, 1.6.x, 1.7.x) promptly.

Source document (simplified)

Premier Ministre S.G.D.S.N

Agence nationale
de la sécurité des
systèmes d'information

Paris, le 19 mars 2026 N° CERTFR-2026-AVI-0320 Affaire suivie par: CERT-FR

Avis du CERT-FR

Objet: Multiples vulnérabilités dans Roundcube

Gestion du document

Risques

Atteinte à la confidentialité des données
Contournement de la politique de sécurité
Falsification de requêtes côté serveur (SSRF)
Injection de code indirecte à distance (XSS)
Injection de requêtes illégitimes par rebond (CSRF)

Systèmes affectés

Roundcube Webmail versions 1.5.x antérieures à 1.5.14
Roundcube Webmail versions 1.6.x antérieures à 1.6.14
Roundcube Webmail versions 1.7.x antérieures à 1.7-rc5

Résumé

De multiples vulnérabilités ont été découvertes dans Roundcube. Certaines d'entre elles permettent à un attaquant de provoquer une atteinte à la confidentialité des données, une falsification de requêtes côté serveur (SSRF) et une injection de code indirecte à distance (XSS).