CVE-2026-114714
published 2026-10-22CVE-2026-114714: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based…
PriorityP335medium5.3CVSS 3.1
AVNACHPRLUINSUCHINAN
EPSS
0.37%
29.3th percentile
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| roundcube | webmail | >= 1.6.0 < 1.6.20 | 1.6.20 |
| roundcube | webmail | >= 1.7.0 < 1.7.5 | 1.7.5 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Roundcube Webmail up to 1.6.19/1.7.4 squirrelmail_usercopy plugin login name path traversal
vuldb·2026-10-22·CVSS 5.3
CVE-2026-114714 [MEDIUM] Roundcube Webmail up to 1.6.19/1.7.4 squirrelmail_usercopy plugin login name path traversal
A vulnerability marked as problematic has been reported in Roundcube Webmail up to 1.6.19/1.7.4. This vulnerability affects unknown code of the component squirrelmail_usercopy plugin. This manipulation of the argument login name causes path traversal.
This vulnerability is registered as CVE-2026-114714. Remote exploitation of the attack is possible. No exploit is available.
It is suggested to upgrade the affected component.
GHSA
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin.
ghsa_unreviewed·2026-10-22
CVE-2026-114714 [MEDIUM] CWE-23 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://bugs.debian.org/1151279https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6https://github.com/roundcube/roundcubemail/commit/dbdfcac498164bcacb7ce273b6341678dd70c166https://github.com/roundcube/roundcubemail/releases/tag/1.6.20https://github.com/roundcube/roundcubemail/releases/tag/1.7.5https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
2026-10-22
Published