Loading vulnerability…
IMAP Command Injection in Roundcube Webmail Mail Search
Roundcube Webmail before version 1.6.18 and versions 1.7.x before 1.7.3 contain an IMAP command injection vulnerability involving mail search and byte-count desynchronization in the IMAP LITERAL+ extension. The desynchronization can allow attacker-controlled input to be interpreted as IMAP commands, potentially resulting in information disclosure or privilege escalation.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can disclose information without authorization or escalate privileges through injected IMAP commands. The vulnerability is rated high severity with a reported CVSS score of 7.1. The specific information exposed and scope of privilege escalation are not established.
If you can’t patch tonight, do this now.
Apply the vendor-supported update. No separate workaround is specified. Until patching is complete, restrict access to Roundcube to trusted users and networks where operationally feasible, and monitor Roundcube and IMAP logs for anomalous search activity or unexpected IMAP commands.
Patch, then assume compromise.
Upgrade Roundcube Webmail to version 1.6.18 or later in the 1.6 branch, or version 1.7.3 or later in the 1.7 branch. For Debian stable (trixie), upgrade the Roundcube packages to version 1.6.18+dfsg-0+deb13u1 or later through Debian security updates.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.