CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 4.6 Medium
AV:L/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-552
- Updated
- 2026-11-02
CVE List
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-552
- Updated
- 2026-11-02
EUVDEUVD-2017-7838
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
EUVD-2017-7838- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6r67-r3jm-88p4
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized...
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
GHSA-6r67-r3jm-88p4- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-552
- Updated
- 2026-11-02
CISA KEV No score
Roundcube Webmail File Disclosure Vulnerability
Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.
- Record
CVE-2017-16651- Weakness
- CWE-552
- Updated
- 2026-11-02
OSVALPINE-CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
ALPINE-CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSV
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
DEBIAN-CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-16651
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
- Record
UBUNTU-CVE-2017-16651- CVSS 3.1
- 7.8 High
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - CVSS 3.0
- 7.8 High
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0409 No score
Updated roundcubemail packages fix security vulnerability
It was discovered that roundcubemail contained a zero-day file disclosure vulnerability caused by insuficient input validation which was currently being exploited by hackers to read roundcube's configuration files and steal its database credentials (CVE-2017-16651).
- Record
MGASA-2017-0409- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11303-1 No score
roundcubemail-1.4.11-1.3 on GA media
These are all security issues fixed in the roundcubemail-1.4.11-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11303-1- Updated
- 2026-11-02
OSVUSN-7200-1 No score
roundcube vulnerability
It was discovered that Roundcube incorrectly handled certain file-based attachment plugins. An attacker could exploit this to gain unauthorized access to arbitrary files on the host’s file system.
- Record
USN-7200-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubemailAlpine:v3.3 |
before 1.1.10-r0 | 1.1.10-r0 |
roundcubemailAlpine:v3.4 |
before 1.2.7-r0 | 1.2.7-r0 |
roundcubemailAlpine:v3.5 |
before 1.2.7-r0 | 1.2.7-r0 |
roundcubeDebian:12 |
before 1.3.3+dfsg.1-1 | 1.3.3+dfsg.1-1 |
roundcubeDebian:13 |
before 1.3.3+dfsg.1-1 | 1.3.3+dfsg.1-1 |
roundcubeDebian:14 |
before 1.3.3+dfsg.1-1 | 1.3.3+dfsg.1-1 |
roundcubeDebian:7 |
before 0.7.2-9+deb7u9, plus listed versions 0.7.2-90.7.2-9+deb7u10.7.2-9+deb7u20.7.2-9+deb7u30.7.2-9+deb7u4 Show 4 moreShow less0.7.2-9+deb7u50.7.2-9+deb7u60.7.2-9+deb7u70.7.2-9+deb7u8 |
0.7.2-9+deb7u9 |
roundcubeDebian:9 |
before 1.2.3+dfsg.1-4+deb9u1, plus listed versions 1.2.3+dfsg.1-4 |
1.2.3+dfsg.1-4+deb9u1 |
roundcubemailMageia:5 |
before 1.0.11-1.1.mga5 | 1.0.11-1.1.mga5 |
roundcubemailMageia:6 |
before 1.2.5-1.1.mga6 | 1.2.5-1.1.mga6 |
roundcubeUbuntu:Pro:16.04:LTS |
before 1.2~beta+dfsg.1-0ubuntu1+esm5, plus listed versions 1.1.1+dfsg.1-21.1.2+dfsg.1-51.1.3+dfsg.1-11.1.4+dfsg.1-11.2~beta+dfsg.1-0ubuntu1 Show 4 moreShow less1.2~beta+dfsg.1-0ubuntu1+esm11.2~beta+dfsg.1-0ubuntu1+esm21.2~beta+dfsg.1-0ubuntu1+esm31.2~beta+dfsg.1-0ubuntu1+esm4 |
1.2~beta+dfsg.1-0ubuntu1+esm5 |
roundcubemailopenSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 1.4.11-1.3 | 1.4.11-1.3 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | ropbear/CVE-2017-16651 | 2021-01-06 |
| Metasploit | Roundcube TimeZone Authenticated File Disclosure | 2017-11-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation, exploits | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, Metasploit, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-16651 is a high vulnerability (CVSS 7.8) in Roundcube Webmail, published November 9, 2017. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 45.7%, the 98th percentile. Fixed in roundcubemail 1.1.10-r0.
References
github.com/roundcube/roundcubemail/releases/tag/1.3.3
roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10
lists.debian.org/debian-lts-announce/2017/11/msg00039.html
securityfocus.com/bid/101793
Show 22 moreShow less
debian.org/security/2017/dsa-4030
packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651
nvd.nist.gov/vuln/detail/CVE-2017-16651
security.alpinelinux.org/vuln/CVE-2017-16651
security-tracker.debian.org/tracker/CVE-2017-16651
advisories.mageia.org/MGASA-2017-0409.html
bugs.mageia.org/show_bug.cgi?id=22005
ubuntu.com/security/CVE-2017-16651
cve.org/CVERecord?id=CVE-2017-16651
suse.com/security/cve/CVE-2017-16651