CVE-2026-114714 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 represents a critical security flaw within the squirrelmail_usercopy plugin, specifically affecting deployments that utilize the file-based backend for user data storage. This issue is classified as a path traversal vulnerability, which allows an attacker to manipulate input variables to access resources outside of their intended directory scope. The core technical failure lies in how the application constructs the source file path during the import process. Instead of sanitizing or validating the login name provided by the user, the software directly incorporates this untrusted input into the filesystem path without rejecting special characters such as forward slashes. This lack of validation creates a direct vector for directory traversal attacks, where an attacker can inject sequence elements to break out of the designated data directory and access arbitrary files on the underlying system.
From an operational perspective, the impact of this vulnerability is severe because it compromises the confidentiality of sensitive user data stored by Roundcube. Since the squirrelmail_usercopy plugin facilitates the migration or importation of email accounts from SquirrelMail environments, it handles potentially large volumes of personal and professional correspondence. By exploiting the path traversal flaw, an authenticated attacker with a maliciously crafted username can read files located outside the configured squirrelmail_data_dir. This could lead to the exposure of other users' emails, configuration files containing credentials or API keys, system logs revealing internal network topology, or even sensitive application code if directory permissions are misconfigured. The ability to import these unauthorized files means that an attacker does not just view data but can potentially integrate malicious content into their own mailbox, further complicating forensic analysis and increasing the risk of subsequent attacks such as phishing or social engineering using stolen context.
This vulnerability aligns with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes flaws where software does not properly neutralize special elements within a pathname that can cause the path to resolve to a location outside of the restricted directory. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1083: File and Directory Discovery, as it enables an attacker to enumerate and access files in unintended locations on the host system. The root cause stems from insufficient input validation at the point where user-supplied data is concatenated into filesystem operations. While Roundcube implements various security measures for web-based interactions, this specific plugin failed to apply strict allow-listing or sanitization rules to the login identifier used as a file path component, assuming that standard alphanumeric characters would be the only valid inputs without accounting for maliciously crafted strings containing directory separators.
The upstream resolution addresses this issue by modifying the code logic in the squirrelmail_usercopy plugin to explicitly reject any login names that contain forward slash characters. This fix ensures that user input is strictly validated before being used in path construction, thereby preventing the traversal of parent directories and restricting file access solely within the intended data directory boundaries. To mitigate this risk immediately upon upgrading or while planning for patch deployment, administrators should ensure they are running Roundcube version 1.6.20 or later, or version 1.7.5 and above. Additionally, organizations employing older versions that cannot be patched immediately should consider implementing web application firewall rules to block requests containing path traversal sequences in login parameters related to the squirrelmail_usercopy plugin. Regular audits of file permissions on the server hosting Roundcube are also recommended to ensure that even if a vulnerability is exploited, the principle of least privilege limits the potential damage by restricting read access to only necessary files and directories for the web application user account.