CVE-2017-16651: Roundcube Webmail File Disclosure Vulnerability
Vulnerability summary
CVE-2017-16651 is a high (CVSS 7.8) vulnerability in Roundcube Roundcube Webmail. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 45.74% chance of exploitation in the next 30 days, higher than 98.7% of scored vulnerabilities. 2 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 1Timeline
- 09-11-2017PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVRoundcube Webmail File Disclosure Vulnerability
- 03-05-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CVSS metrics
7 scores · 5 sources · 3 versions- NVDNIST7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · AlpineEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
45.74%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
+9.07 pp
From 36.67% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 03-05-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2017-16651
Public exploits
2 foundExploit Reference (packetstormsecurity.com)
Maturity: unknown
Roundcube TimeZone Authenticated File Disclosure
auxiliary/gather/roundcube_auth_file_read
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Debian2 products
- roundcube< 1.3.3+dfsg.1-1 | < 1.2.3+dfsg.1-4+deb9u1 | < 0.7.2-9+deb7u9
- debian_linuxEOL7.0 | 9.0
Mageia2 products
- roundcubemail< 1.0.11-1.1.mga5
- roundcubemail< 1.2.5-1.1.mga6
Alpine1 product
- roundcubemail< 1.1.10-r0 | < 1.2.7-r0
Roundcube1 product
- webmailEOL≤ 1.1.9 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.3.0 | 1.3.1 | 1.3.2
Ubuntu1 product
- roundcube< 1.2~beta+dfsg.1-0ubuntu1+esm5
5 vendors · 7 products
References
18 links- github.com/roundcube/roundcubemail/releases/tag/1.3.3X Refsource CONFIRMIssue TrackingRelease NotesThird Party AdvisoryREPORT
- roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10X Refsource CONFIRMIssue TrackingVendor AdvisoryWEBREPORT
lists.debian.org/debian-lts-announce/2017/11/msg00039.htmlMailing ListX Refsource MLISTThird Party Advisory- github.com/roundcube/roundcubemail/releases/tag/1.1.10X Refsource CONFIRMIssue TrackingRelease NotesThird Party AdvisoryREPORT
- github.com/roundcube/roundcubemail/releases/tag/1.2.7X Refsource CONFIRMIssue TrackingRelease NotesThird Party AdvisoryREPORT
- www.debian.org/security/2017/dsa-4030Vendor AdvisoryX Refsource DEBIANIssue TrackingThird Party AdvisoryWEB
- github.com/roundcube/roundcubemail/issues/6026X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
- packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651Government ResourceUS Government Resource