AIKIDO-2026-988498
roundcube/roundcubemail is vulnerable to Remote Code Execution (RCE)
88
High Risk
This Affects:
roundcube/roundcubemailTL;DR
Roundcube 1.7.3 fixes eleven security issues affecting the webmail core and plugins, including **remote code execution, IMAP command injection, SSRF, stored XSS, LDAP filter injection, and sensitive information disclosure**. The most severe issue, **CVE-2026-74997**, allows remote code execution through the markasjunk plugin, while others allow attackers to bypass SSRF and remote-content protections, inject commands or filters, bypass Sieve restrictions, or expose API credentials.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
roundcube/roundcubemail is vulnerable to Remote Code Execution (RCE) in versions 1.6.0 - 1.7.2.
How to fix this
Upgrade the roundcube/roundcubemail library to the patch version.
Links
GitHub Releases
Fix Commits
github.com/roundcube/roundcubemail/commit/14044f843cfacbe78b042f659e379d6b4497aa7cgithub.com/roundcube/roundcubemail/commit/495d211638f222336b20f4744545c53712426c2agithub.com/roundcube/roundcubemail/commit/b8f90e28a46d42e79a69568cba897f8f4223d9cd
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.