{"id":"CVE-2018-9846","aliases":["ALPINE-CVE-2018-9846","DEBIAN-CVE-2018-9846","DSA-4181-1","EUVD-2018-21440","GHSA-3v75-9ch3-wfrw","MGASA-2018-0288","UBUNTU-CVE-2018-9846","openSUSE-SU-2024:11303-1"],"status":"published","title":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's...","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","severity":{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02283,"percentile":0.83257,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2018-04-07T21:00:00Z","modified":"2026-11-03T06:32:28Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"roundcubemail","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"roundcubemail","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"roundcubemail","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"roundcubemail","fixed_in":["1.3.6-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"roundcube","fixed_in":["1.3.6+dfsg.1-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"roundcube","fixed_in":["1.2.3+dfsg.1-4+deb9u2"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"roundcubemail","fixed_in":["1.3.6-1.1.mga6"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","fixed_in":["1.2~beta+dfsg.1-0ubuntu1+esm7"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6+dfsg.1-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2.3+dfsg.1-4+deb9u2"}]}],"versions":["1.2.3+dfsg.1-4","1.2.3+dfsg.1-4+deb9u1"]},{"source":"osv","ecosystem":"Mageia:6","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.6-1.1.mga6"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"roundcube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.2~beta+dfsg.1-0ubuntu1+esm7"}]}],"versions":["1.1.1+dfsg.1-2","1.1.2+dfsg.1-5","1.1.3+dfsg.1-1","1.1.4+dfsg.1-1","1.2~beta+dfsg.1-0ubuntu1","1.2~beta+dfsg.1-0ubuntu1+esm1","1.2~beta+dfsg.1-0ubuntu1+esm2","1.2~beta+dfsg.1-0ubuntu1+esm3","1.2~beta+dfsg.1-0ubuntu1+esm4","1.2~beta+dfsg.1-0ubuntu1+esm5","1.2~beta+dfsg.1-0ubuntu1+esm6"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.11-1.3"}]}],"bundled":8}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"roundcube","product":"webmail"}],"references":[{"url":"https://github.com/roundcube/roundcubemail/issues/6238","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://www.debian.org/security/2018/dsa-4181","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/roundcube/roundcubemail/issues/6229","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://medium.com/%40ndrbasi/cve-2018-9846-roundcube-303097048b0a","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9846"},{"url":"https://medium.com/@ndrbasi/cve-2018-9846-roundcube-303097048b0a","tags":["report"]},{"url":"https://github.com/advisories/GHSA-3v75-9ch3-wfrw"},{"url":"https://security.alpinelinux.org/vuln/CVE-2018-9846","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-9846","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0288.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22941","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/Z5Z2OC2XYT33AXQAC6NBFEM5PJNFVZRR/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-9846","tags":["report"]},{"url":"https://github.com/roundcube/roundcubemail/commit/e3dd5b66d236867572e68fcb80281e9268a0cfb0","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-9846","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8132-1","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16651","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-6820","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-8114","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-9846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10740","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-12641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-16145","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-35730","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:00:00Z","modified":"2024-08-05T07:24:56.298Z","updated_at":"2026-11-02T14:35:02.603326Z"}],"euvd":[{"id":"EUVD-2018-21440","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:00:00Z","modified":"2024-08-05T07:24:56Z","updated_at":"2026-11-03T02:40:00.040327Z"}],"ghsa":[{"id":"GHSA-3v75-9ch3-wfrw","title":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's...","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2022-05-14T03:21:15Z","modified":"2023-02-02T05:08:06Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:52:39.875078Z"}],"nvd":[{"id":"CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:29:00.413Z","modified":"2026-06-17T02:07:17Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:04:24.700429Z"}],"osv":[{"id":"ALPINE-CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:29:00.413Z","modified":"2026-11-03T06:32:28.769852588Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T07:17:41.158523Z"},{"id":"CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:29:00.413Z","modified":"2026-10-20T10:50:32.572822046Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:10.051046Z"},{"id":"DEBIAN-CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:29:00.413Z","modified":"2026-10-23T18:03:10.134423401Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:31.170944Z"},{"id":"UBUNTU-CVE-2018-9846","description":"In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled \"_uid\" parameter (in an archive.php _task=mail\u0026_mbox=INBOX\u0026_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism.","status":"published","published":"2018-04-07T21:29:00Z","modified":"2026-03-31T17:54:10.65326Z","cvss":[{"version":"3.0","score":8.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:18.772093Z"},{"id":"DSA-4181-1","title":"roundcube - security update","status":"published","published":"2018-04-28T00:00:00Z","modified":"2026-03-09T01:20:40.073825Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"MGASA-2018-0288","title":"Updated roundcubemail packages fix security vulnerability","description":"Updated roundcubemail package fixes security vulnerability:\n\nThis update fixes a recently discovered IMAP command injection vulnerability \ncaused by insufficient input validation within the archive plugin. \n(CVE-2018-9846).\n","status":"published","published":"2018-06-19T23:42:28Z","modified":"2026-04-16T06:23:10.180038975Z","updated_at":"2026-11-02T15:49:40.793816Z"},{"id":"openSUSE-SU-2024:11303-1","title":"roundcubemail-1.4.11-1.3 on GA media","description":"These are all security issues fixed in the roundcubemail-1.4.11-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:43.051285Z","updated_at":"2026-11-02T16:58:34.894275Z"}]}}