SOURCE FACT
Roundcube · Roundcube Webmail
Roundcube Webmail is vulnerable to SQL injection via search or search_params.
Required action
Apply updates per vendor instructions.
CISA notes
https://roundcube.net/news/2021/11/12/security-updates-1.4.12-and-1.3.17-released; https://nvd.nist.gov/vuln/detail/CVE-2021-44026
View source evidence →