Live › vulnerability › CVE-2026-114714
Go to dashboardThe squirrelmail_usercopy plugin in Roundcube Webmail builds a file path from the login name without rejecting slashes, so a crafted login name can point the import outside the configured data directory. An attacker can make files outside squirrelmail_data_dir be read and imported into the mailbox.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Installations that run Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 with the squirrelmail_usercopy plugin enabled and the file based backend in use. Installations without that plugin, or using another backend, are not exposed by this path.
No product ranges from the sources yet.
grep -i version program/include/iniset.php and look at the installed releaseconfig/config.inc.php and that it uses the file based backend with squirrelmail_data_dir set1.6.20 or later on the 1.6 line, or to 1.7.5 or later on the 1.7 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.
This page as .md · .json · in your agent: get_signal("CVE-2026-114714")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.