CVE-2026-114714 Roundcube CVE debrief

Who should care

Defenders responsible for Roundcube Webmail installations should assess exposure and prioritize updates to versions 1.6.20 or 1.7.5. Restricting login names and monitoring for unusual activity are also recommended.

Why it matters

CVE-2026-114714 is a path traversal vulnerability in Roundcube Webmail's squirrelmail_usercopy plugin. Defenders should prioritize verifying and updating installations to prevent potential unauthorized file access and data import.

• Potential unauthorized file access
• Possible data import from outside configured directories
• Need for verification of login name restrictions
• Priority for updating to fixed versions

Technical summary

The squirrelmail_usercopy plugin in Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is vulnerable to a path traversal attack. By using a login name containing a slash, an attacker can read and import files outside the configured squirrelmail_data_dir. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. The fix involves rejecting login names containing a slash. The vulnerability affects Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. Defenders should prioritize verifying and updating installations to prevent potential unauthorized file access and data import.

Defensive priority

Defenders should prioritize verifying and updating Roundcube Webmail installations to versions 1.6.20 or 1.7.5, and restrict login names to prevent path traversal attempts.

Recommended defensive actions

• Verify and update Roundcube Webmail installations to versions 1.6.20 or 1.7.5
• Restrict login names to prevent path traversal attempts
• Monitor for unusual activity in Roundcube Webmail logs
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while references from Debian and Roundcube's GitHub repository offer additional context and fixes. The vulnerability was reported by a researcher and fixed by the vendor. The fix involves rejecting login names containing a slash. The vulnerability affects Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. The evidence is based on the CVE record, NVD entry, and vendor documentation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.