ZeroDay Findings
Sign inSign up

Findings

CVE-2021-44026

Roundcube Webmail SQL Injection Vulnerability

Published Nov 18, 2021 · updated Jun 16, 2026 · roundcube webmail

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 18, 2021 · Catalog

    Detected

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

  2. Jun 22, 2023 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Jul 13, 2023 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

Required action

Apply updates per vendor instructions.

CISA due date Jul 13, 2023

Affected

  • cpe debian/debian linux10.0
  • cpe debian/debian linux11.0
  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora33
  • cpe fedoraproject/fedora34
  • cpe roundcube/webmailversion unspecified
  • vendor Roundcube Roundcube Webmailversion unspecified

Sources

  • CISA KEVConfirmed exploitationCVE-2021-44026

    Roundcube Webmail is vulnerable to SQL injection via search or search_params.

    cisa.gov
  • CVE.orgVulnerability recordCVE-2021-44026

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-44026

    30-day exploitation probability 69.9%

    first.org
  • NIST NVDVulnerability recordCVE-2021-44026

    Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

    nvd.nist.gov

References