Roundcube: Schwachstelle ermöglicht Codeausführung
NEOSEC enrichment — no mirror of the original source
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Roundcube ausnutzen, um beliebigen Programmcode auszuführen.
Source: BSI CERT-Bund. For licensing reasons NEOSEC Intel does not mirror the full text verbatim. The full text and expert commentary are available at the original source.
Read the issue at BSI CERT-BundFull advisory
Highbsi:WID-SEC-2025-12080 linked CVEs
Open advisory with all CVEs
More on Roundcube
Other advisories
- HighCVE-2026-75000Roundcube Webmail: Mehrere Schwachstellen
- CriticalCVE-2026-54432Roundcube: Mehrere Schwachstellen
- Highbsi:WID-SEC-2025-1208Roundcube: Schwachstelle ermöglicht Codeausführung
- HighCVE-2026-113386Roundcube Webmail: Mehrere Schwachstellen
- Not ratedosv:openSUSE-SU-2026:22195-1Security update for roundcubemail
- MediumCVE-2026-107147The twofactor_gauthenticator plugin for Roundcube is vulnerable to 2fa authentication bypass by spoofed client address headers. Due to the lack of validation…
- MediumCVE-2026-107146The twofactor_gauthenticator plugin for Roundcube is vulnerable to session persistence after failed 2FA verification. Due to the lack of server-side session …
- MediumCVE-2026-107145The twofactor_gauthenticator plugin for Roundcube is vulnerable to brute-forcing of the second-factor code. Due to the lack of rate limiting, an attacker who…
Other news entries
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Roundcube Webmail: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
- Multiples vulnérabilités dans Roundcube Webmail (19 octobre 2026)NewsCERT-FR (ANSSI)
- Multiples vulnérabilités dans Roundcube Webmail (19 octobre 2026)NewsCERT-FR (ANSSI)
- Roundcube Pre-Auth SQL Injection Flaw Actively Exploited in the WildNewsThe Hacker News
- Roundcube Webmail Vulnerability in Attackers’ CrosshairsNewsSecurityWeek
- Hackers now exploit critical Roundcube flaw in code injection attacksNewsBleepingComputer
- Roundcube: Mehrere SchwachstellenVulnerabilityBSI CERT-Bund
Source: https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-1208
ID