{"id":"CVE-2026-114714","kind":"vulnerability","aliases":["CVE-2026-114714"],"related":[],"title":"Roundcube: login name path traversal reads files outside data directory","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source path was built from the login name without rejecting path separators, so a login name containing a slash could cause files outside the configured squirrelmail_data_dir to be read and imported. Upstream fixed this in the commit “Fix unsafe use of a login name in SquirrelMail import file path”, which rejects login names containing a slash.","summary":"The squirrelmail_usercopy plugin in Roundcube Webmail builds a file path from the login name without rejecting slashes, so a crafted login name can point the import outside the configured data directory. An attacker can make files outside squirrelmail_data_dir be read and imported into the mailbox.","severity":"medium","cvss":5.3,"epss":0.00367,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","roundcube","self-hosted","webmail"],"not_affected_if":["non-file-backend","patched-version","plugin-disabled"],"how_to_check":"- Check the Roundcube version with `grep -i version program/include/iniset.php` and look at the installed release\n- Confirm the squirrelmail_usercopy plugin is enabled in `config/config.inc.php` and that it uses the file based backend with squirrelmail_data_dir set","fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or to `1.7.5` or later on the 1.7 line\n- Until upgraded, disable the squirrelmail_usercopy plugin","status":"open","published_at":"2026-10-22T01:16:58+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T04:20:45+00:00","updated_at":"2026-10-25T04:20:45+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:20:45Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` or later on the 1.6 line, or to `1.7.5` or later on the 1.7 line\n- Until upgraded, disable the squirrelmail_usercopy plugin","reach":"unknown","title":"Roundcube: login name path traversal reads files outside data directory","impact":"medium","summary":"The squirrelmail_usercopy plugin in Roundcube Webmail builds a file path from the login name without rejecting slashes, so a crafted login name can point the import outside the configured data directory. An attacker can make files outside squirrelmail_data_dir be read and imported into the mailbox.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","webmail","php"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Files outside the data directory are read and imported into mailboxes","analyst_note":"","how_to_check":"- Check the Roundcube version with `grep -i version program/include/iniset.php` and look at the installed release\n- Confirm the squirrelmail_usercopy plugin is enabled in `config/config.inc.php` and that it uses the file based backend with squirrelmail_data_dir set","needs_analyst":false,"not_affected_if":["plugin-disabled","non-file-backend","patched-version"],"who_is_affected":"Installations that run Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 with the squirrelmail_usercopy plugin enabled and the file based backend in use. Installations without that plugin, or using another backend, are not exposed by this path.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000642,"input_tokens":3443,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114714':13A,16A '-2026':12A,15A '1.6.20':75C '1.7':77C '1.7.5':80C 'affect':82C 'attack':57B 'backend':97C 'base':96C 'build':31B 'built':102C 'caus':119C 'commit':137C 'configur':53B,123C 'contain':115C,154C 'could':118C 'craft':44B 'cve':11A,14A 'data':9A,54B,63B,125C 'dir':64B,126C 'directori':10A,55B 'file':7A,33B,60B,95C,120C,148C 'fix':133C,138C 'host':22B 'import':50B,68B,131C,147C 'login':2A,37B,45B,105C,113C,143C,152C 'mailbox':71B 'make':59B 'name':3A,38B,46B,106C,114C,144C,153C 'outsid':8A,51B,61B,121C 'packag':17B 'path':4A,34B,85C,100C,109C,149C 'php':18B 'plugin':27B,92C 'point':48B 'read':6A,66B,129C 'reject':40B,108C,151C 'roundcub':1A,19B,29B,72C 'self':21B 'self-host':20B 'separ':110C 'slash':41B,117C,156C 'sourc':99C 'squirrelmail':25B,62B,90C,124C,146C 'travers':5A,86C 'unsaf':139C 'upstream':132C 'use':140C 'usercopi':26B,91C 'vulner':87C 'webmail':23B,30B,73C 'without':39B,107C 'x':78C","nicknames":[],"mitigations":[],"who_affected":"Installations that run Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 with the squirrelmail_usercopy plugin enabled and the file based backend in use. Installations without that plugin, or using another backend, are not exposed by this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T01:16:58+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114714","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114714","severity":null,"published_at":"2026-10-22T01:16:58+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114714","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114714","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}