CVE-2026-114714
Description
A flaw was found in Roundcube Webmail. When using the squirrelmail_usercopy plugin with a file-based backend, the application constructs file paths from user login names without properly sanitizing path separators. An authenticated remote attacker can exploit this path traversal vulnerability by submitting a crafted login name, leading to unauthorized information disclosure through reading and importing files outside the intended directory.
Statement
A path traversal vulnerability was found in Roundcube Webmail's squirrelmail_usercopy plugin. When the non-default plugin is enabled with the file-based backend and an authentication backend that permits slashes in login names, an authenticated remote attacker could submit a crafted login name containing path separators, causing files outside the configured squirrelmail_data_dir to be read and imported, resulting in information disclosure. Upstream fixed this issue in Roundcube Webmail 1.6.20 and 1.7.5 by rejecting login names containing a slash. Red Hat does not ship Roundcube Webmail in any supported Red Hat product; the affected packages exist only in community streams (fedora-all roundcubemail 1.6.19-1.fc43, epel-all roundcubemail 1.5.15-1.el9).
Mitigation
Disable the squirrelmail_usercopy plugin or upgrade to Roundcube Webmail 1.6.20 or 1.7.5.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
