Roundcube Webmail vulnerabilities

In Roundcube Webmail before versions 1.5.15 and 1.6.15, the remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosure or access-control bypass. This involves the animate element with attributeName=fill/filter/stroke.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, insufficient CSS sanitization in HTML messages was found. This allows bypassing fixed-position mitigation via the !important directive.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via SVG content with animate attributes in an email message. This may lead to information disclosure or access-control bypass.

In Roundcube Webmail before versions 1.5.14 and 1.6.14, the remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an email message. This may lead to information disclosure or access-control bypass.

Roundcube Webmail before versions 1.5.14 and 1.6.14 has incorrect password comparison in the password plugin, leading to type confusion that allows password change without knowing the old password.

In Roundcube Webmail from version 1.6.0 to 1.6.14, insufficient CSS sanitization in HTML emails may lead to SSRF or information disclosure, e.g., when stylesheet links point to local network hosts.

An XSS vulnerability was found in Roundcube Webmail before versions 1.5.14 and 1.6.14 due to insufficient sanitization of HTML attachments in preview mode. The victim must preview a text/html attachment.

An issue was discovered in Roundcube Webmail before versions 1.5.14 and 1.6.14 where unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

Roundcube Webmail before versions 1.5.14 and 1.6.14 has an unsafe deserialization vulnerability in the redis/memcache session handler, which can lead to arbitrary file write operations by unauthenticated attackers.