Critical Vulnerability Discovered in RoundCube Webmail

What changed

A newly discovered vulnerability in RoundCube Webmail enables remote code execution due to improper validation of the _from parameter. This flaw affects versions prior to 1.5.10 and 1.6.x before 1.6.11, specifically in the program/actions/settings/upload.php file.

The vulnerability arises from PHP Object Deserialization, which can be exploited by authenticated users, raising concerns about the integrity and security of user data.

Who is affected

The vulnerability impacts various users and organizations utilizing RoundCube Webmail, particularly those running outdated versions of the software.

Key affected groups include:

• Organizations using RoundCube Webmail for internal communications.
• Service providers offering RoundCube as part of their email solutions.
• Educational institutions relying on RoundCube for student and faculty email services.
• Any entity that has not updated to the latest versions of RoundCube Webmail.

What to do

To mitigate the risks associated with this vulnerability, users and administrators are strongly advised to update their RoundCube installations to the latest versions as soon as possible.

Regularly reviewing security practices and ensuring timely updates can significantly reduce the risk of exploitation.

• Upgrade to RoundCube Webmail version 1.5.10 or 1.6.11 or later.
• Implement additional security measures to monitor and restrict access to email systems.
• Educate users about the potential risks associated with outdated software.