Skip to content
Sign in
4.3 Medium

CVE-2026-75004 In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to…

Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue only affects Roundcube instances using the managesieve plugin.

Affected products and versions

Product Affected versions Fixed in
Webmail 1.7 1.7.0 → < 1.7.3 1.7.3
Webmail 1.6 1.6.0 → < 1.6.18 1.6.18

Other CVEs of Webmail

The 62 CVEs of Webmail →
CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in… 6.8 Medium CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability… 5.3 Medium CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass 7.2 High CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass 5.3 Medium
Track this CVE