CVE-2026-75007: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.

Also Affects

Downstream vendors/products affected by this vulnerability

References

• https://roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.18
• https://github.com/roundcube/roundcubemail/commit/e6cc1e121effeaec6d916feb4e019d2828924540
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.3
• https://github.com/roundcube/roundcubemail/commit/0893e192adf803c7a5a89fafc80278257e1bcf65

Related News (3 articles)

Discussion (0)

Loading…