Roundcube Webmail Vulnerability Allows Hackers to Execute Malicious SQL Queries

Roundcube Webmail users are being urged to update their systems immediately after the disclosure of multiple security vulnerabilities, including a critical pre-authentication SQL injection flaw that allows attackers to execute malicious database queries without requiring login access.

The vulnerabilities were patched in newly released versions 1.6.16 and 1.7.1, published on May 24, 2026, as part of an important security update affecting both long-term support and current versions.

Roundcube Webmail Vulnerability

The most critical issue involves a pre-auth SQL injection vulnerability in the virtuser_query plugin. This flaw is caused by improper input sanitization due to a preg_replace backslash escape bypass, which allows attackers to inject arbitrary SQL commands before authentication.

Because the attack does not require valid credentials, it significantly increases the risk of exploitation. Threat actors could potentially access sensitive data, manipulate database contents, or escalate privileges within affected systems.

In addition to the SQL injection flaw, the Roundcube team also addressed a code injection vulnerability tied to the LDAP autovalues option.

This issue originated from unsafe support for code evaluation, which has now been removed to prevent attackers from executing arbitrary code remotely. The update further resolves multiple injection and bypass vulnerabilities that could be combined in complex attack chains.

Several client-side and server-side security flaws were also fixed, including a stored XSS vulnerability in the draft restore dialog subject field and a CSS injection bypass using SVG animate elements.

Security Flaws Addressed

• Stored XSS vulnerability in the draft restore dialog subject field, allowing HTML and CSS injection
• CSS injection bypass in HTML sanitizer via SVG animate attributeName style manipulation
• Pre-auth SQL injection in virtuser_query plugin through preg_replace backslash escape bypass
• SSRF bypass using specially crafted local address URLs
• Remote resource fetch bypass when remote resources were blocked
• Remote image blocking bypass via CSS var() manipulation
• Pre-auth arbitrary file deletion via Redis and Memcache session poisoning
• Code injection vulnerability due to unsafe code evaluation in LDAP autovalues option

Other issues include an SSRF bypass via specially crafted local address URLs, a bypass of restrictions on fetching remote resources, and a bypass of remote image blocking via CSS var() manipulation.

Additionally, a pre-auth arbitrary file deletion vulnerability caused by session poisoning in Redis or Memcache configurations has been resolved.

These vulnerabilities were reported by multiple security researchers and teams, including Orange Cyberdefense Vulnerability Disclosure Team and independent contributors, highlighting the importance of coordinated vulnerability disclosure and rapid patch deployment.

All Roundcube installations running versions 1.6. x and 1.7. x are affected by these issues. Administrators are strongly advised to upgrade immediately to version 1.6.16 or 1.7.1 to mitigate the risks.

Organizations should also review system logs for suspicious activity, turn off unnecessary plugins such as virtuser_query, and enforce strict access controls to minimize exposure.

Given the severity and number of vulnerabilities addressed, this release is considered critical. Organizations using Roundcube Webmail, especially in internet-facing environments, should prioritize patching and conduct thorough security checks to prevent potential exploitation.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.