Multiple vulnerabilities in Roundcube Webmail (October 19, 2026)

CERT-FR Notice Subject: Multiple vulnerabilities in Roundcube Webmail Document Management Detailed version management is found at the end of this document. Risks - Circumvention of security policy - Remote arbitrary code execution - Server-side request forgery (SSRF) - Cross-site scripting (XSS) - Cross-site request forgery (CSRF) Affected Systems - Roundcube Webmail versions 1.7.x prior to 1.7.5 - Roundcube Webmail versions prior to 1.6.20 Summary Multiple vulnerabilities have been discovered in Roundcube Webmail. Some of these allow an attacker to cause remote arbitrary code execution, server-side request forgery (SSRF), and cross-site scripting (XSS). Solutions Refer to the vendor's security bulletin to obtain patches (see Documentation section). Documentation - Security bulletin Roundcube security-updates-1.6.20-and-1.7.5 of October 19, 2026 https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 - CVE Reference CVE-2026-114715 https://www.cve.org/CVERecord?id=CVE-2026-114715 - CVE Reference CVE-2026-114716 https://www.cve.org/CVERecord?id=CVE-2026-114716 - CVE Reference CVE-2026-114717 https://www.cve.org/CVERecord?id=CVE-2026-114717 - CVE Reference CVE-2026-114718 https://www.cve.org/CVERecord?id=CVE-2026-114718 - CVE Reference CVE-2026-114719 https://www.cve.org/CVERecord?id=CVE-2026-114719 - CVE Reference CVE-2026-114720 https://www.cve.org/CVERecord?id=CVE-2026-114720 - CVE Reference CVE-2026-114721 https://www.cve.org/CVERecord?id=CVE-2026-114721