{"schemaVersion":3,"id":"CVE-2017-16651","aliases":["ALPINE-CVE-2017-16651","MGASA-2017-0409","UBUNTU-CVE-2017-16651","USN-7200-1","DEBIAN-CVE-2017-16651","DLA-1193-1","DSA-4030-1"],"status":"published","duplicateOf":null,"title":"Roundcube Webmail File Disclosure Vulnerability","description":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.","dates":{"published":"2017-11-09T14:00:00.000Z","modified":"2025-10-21T23:55:30.379Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2022-05-03T00:00:00.000Z"]},"cvss":{"headline":{"score":7.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":4.6,"severity":"medium","vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.0","versionLabel":"v3.0","source":"OSV · Ubuntu","score":7.8,"severity":"high","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":7.8,"severity":"high","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","exploitability":4.6,"impact":9.8,"computed":true}]},"epss":{"probability":0.45742,"percentile":0.98788,"severity":"high","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":9.073999999999998,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.36668},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.36919,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.36919,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.36919,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.45742,"percentile":0.98788}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.36668,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.45742,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.45742,"percentile":0.98788}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Roundcube Webmail File Disclosure Vulnerability","description":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","label":"nvd.nist.gov/vuln/detail/CVE-2017-16651"}],"vendor":"Roundcube","product":"Roundcube Webmail","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2022-05-03T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Roundcube Webmail File Disclosure Vulnerability","description":"Roundcube Webmail contains a file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","label":"nvd.nist.gov/vuln/detail/CVE-2017-16651"}],"vendor":"Roundcube","product":"Roundcube Webmail","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_2F5950279EFB4C59","name":"Exploit Reference (packetstormsecurity.com)","source":"reference","url":"http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null},{"id":"MSF_AUXILIARY_GATHER_ROUNDCUBE_AUTH_FILE_READ","name":"Roundcube TimeZone Authenticated File Disclosure","source":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb","maturity":"poc","reliabilityScore":0.5,"verified":false,"type":"remote","platforms":[],"requiresAuth":true,"exploitdb":null,"metasploit":{"fullname":"auxiliary/gather/roundcube_auth_file_read","rank":"300","rankName":"normal","postAuth":true,"check":false,"stability":["crash-safe"],"sideEffects":["ioc-in-logs"],"reliability":[]}}],"exploitCount":2,"weaknesses":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties","description":"The product makes files or directories accessible to unauthorized actors, even though they should not be.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/552.html"}],"affected":[{"vendor":"alpine","product":"roundcubemail","name":"roundcubemail","label":"roundcubemail","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/roundcubemail","purlType":"apk","versions":[{"text":"< 1.1.10-r0","noFixRecorded":false,"fixedIn":null},{"text":"< 1.2.7-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.1.10-r0 | < 1.2.7-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"roundcube","name":"roundcube","label":"roundcube","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/roundcube","purlType":"deb","versions":[{"text":"< 1.3.3+dfsg.1-1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.2.3+dfsg.1-4+deb9u1","noFixRecorded":false,"fixedIn":null},{"text":"< 0.7.2-9+deb7u9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3.3+dfsg.1-1 | < 1.2.3+dfsg.1-4+deb9u1 | < 0.7.2-9+deb7u9","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"roundcube","name":"roundcube","label":"roundcube","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/roundcube","purlType":"deb","versions":[{"text":"< 1.2~beta+dfsg.1-0ubuntu1+esm5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2~beta+dfsg.1-0ubuntu1+esm5","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 9.0","eol":{"isEol":true,"eolDate":"2018-05-31T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (Wheezy)","eolFrom":"2018-05-31T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"7.11"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"mageia","product":"roundcubemail","name":"roundcubemail","label":"roundcubemail","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/roundcubemail","purlType":"rpm","versions":[{"text":"< 1.0.11-1.1.mga5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.0.11-1.1.mga5","eol":null,"hubHref":null},{"vendor":"mageia","product":"roundcubemail","name":"roundcubemail","label":"roundcubemail","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/roundcubemail","purlType":"rpm","versions":[{"text":"< 1.2.5-1.1.mga6","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.5-1.1.mga6","eol":null,"hubHref":null},{"vendor":"roundcube","product":"webmail","name":"Webmail","label":"webmail","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≤ 1.1.9","noFixRecorded":false,"fixedIn":null},{"text":"1.2.0","noFixRecorded":false,"fixedIn":null},{"text":"1.2.1","noFixRecorded":false,"fixedIn":null},{"text":"1.2.2","noFixRecorded":false,"fixedIn":null},{"text":"1.2.3","noFixRecorded":false,"fixedIn":null},{"text":"1.2.4","noFixRecorded":false,"fixedIn":null},{"text":"1.2.5","noFixRecorded":false,"fixedIn":null},{"text":"1.2.6","noFixRecorded":false,"fixedIn":null},{"text":"1.3.0","noFixRecorded":false,"fixedIn":null},{"text":"1.3.1","noFixRecorded":false,"fixedIn":null},{"text":"1.3.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"≤ 1.1.9 | 1.2.0 | 1.2.1 | 1.2.2 | 1.2.3 | 1.2.4 | 1.2.5 | 1.2.6 | 1.3.0 | 1.3.1 | 1.3.2","eol":{"isEol":true,"eolDate":"2021-10-18T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"1.2","label":"1.2","eolFrom":"2021-10-18T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":"1.2.13"},"product":{"name":"roundcube","label":"Roundcube Webmail","category":"server-app"}},"hubHref":"/vendor/roundcube/webmail"}],"affectedCount":7,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.3.3","label":"github.com/roundcube/roundcubemail/releases/tag/1.3.3","hostname":"github.com","tags":["X Refsource CONFIRM","Issue Tracking","Release Notes","Third Party Advisory","REPORT"]},{"url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","label":"roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","hostname":"roundcube.net","tags":["X Refsource CONFIRM","Issue Tracking","Vendor Advisory","WEB","REPORT"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html","label":"lists.debian.org/debian-lts-announce/2017/11/msg00039.html","hostname":"lists.debian.org","tags":["Mailing List","X Refsource MLIST","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.1.10","label":"github.com/roundcube/roundcubemail/releases/tag/1.1.10","hostname":"github.com","tags":["X Refsource CONFIRM","Issue Tracking","Release Notes","Third Party Advisory","REPORT"]},{"url":"http://www.securityfocus.com/bid/101793","label":"www.securityfocus.com/bid/101793","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.2.7","label":"github.com/roundcube/roundcubemail/releases/tag/1.2.7","hostname":"github.com","tags":["X Refsource CONFIRM","Issue Tracking","Release Notes","Third Party Advisory","REPORT"]},{"url":"https://www.debian.org/security/2017/dsa-4030","label":"www.debian.org/security/2017/dsa-4030","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Issue Tracking","Third Party Advisory","WEB"]},{"url":"https://github.com/roundcube/roundcubemail/issues/6026","label":"github.com/roundcube/roundcubemail/issues/6026","hostname":"github.com","tags":["X Refsource CONFIRM","Issue Tracking","Patch","Third Party Advisory","REPORT"]},{"url":"http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","label":"packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","hostname":"packetstormsecurity.com","tags":["X Refsource MISC","Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-16651","label":"security.alpinelinux.org/vuln/CVE-2017-16651","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0409.html","label":"advisories.mageia.org/MGASA-2017-0409.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=22005","label":"bugs.mageia.org/show_bug.cgi?id=22005","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2017-16651","label":"ubuntu.com/security/CVE-2017-16651","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16651","label":"www.cve.org/CVERecord?id=CVE-2017-16651","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7200-1","label":"ubuntu.com/security/notices/USN-7200-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-16651","label":"security-tracker.debian.org/tracker/CVE-2017-16651","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["OPENSUSE-SU-2024:11303-1"],"duplicates":[],"related":["OPENSUSE-SU-2024:11303-1"]},"timeline":[{"kind":"published","date":"2017-11-09T14:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Roundcube Webmail File Disclosure Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2022-05-03T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"modified","date":"2025-10-21T23:55:30.379Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T06:43:50.883Z","stale":false,"partial":false}}