← Vulnerability feed

Vulnerability record · CVE-2015-5382 · published 23 May 2017

CVE-2015-5382: Roundcube webmail information exposure vulnerability

Roundcube · Roundcube Webmail

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

6.5 CVSS 3.0 Medium EPSS 2.9% · top 13.5% CWE-200 · Information exposure
6.5CVSS 3.0 base score, v2 4.0
2.9%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
12References
17 Jun 2026Last modified by NVD

Description

program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via the _alt parameter when uploading a vCard.

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.openwall.com/lists/oss-security/2015/07/07/2 Mailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/3 Mailing ListPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 Issue TrackingPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9 Issue TrackingPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/issues/4817 Issue TrackingPatchThird Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released PatchVendor Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/2 Mailing ListPatchThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/07/07/3 Mailing ListPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 Issue TrackingPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/commit/e84fafcec22e7b460db03248dc23ed6b053b15c9 Issue TrackingPatchThird Party Advisory
https://github.com/roundcube/roundcubemail/issues/4817 Issue TrackingPatchThird Party Advisory
https://roundcube.net/news/2015/06/05/updates-1.1.2-and-1.0.6-released PatchVendor Advisory

Track CVE-2015-5382 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-44026Roundcube Webmail SQL injection via search parametersRoundcube Webmail before 1.3.17 and 1.4.x before 1.4.12 is prone to SQL injection through the search or search_params input. The flaw is remotely rea…KEVEPSS 70%analysed9.8CVE-2020-12641Roundcube Webmail OS command injection via image conversion path settingsRoundcube Webmail before 1.4.4 passes the im_convert_path and im_identify_path configuration settings to a shell without sanitization in rcube_image.…KEVEPSS 84%analysed9.3CVE-2024-42009Roundcube Webmail desanitization XSS in message_body()Roundcube Webmail through 1.5.7 and 1.6.x through 1.6.7 contains a cross-site scripting flaw caused by a desanitization issue in message_body() in pr…KEVEPSS 83%analysed8.8CVE-2025-49113Roundcube Webmail PHP Object Deserialization RCE via _from ParameterRoundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 fails to validate the _from parameter in program/actions/settings/upload.php, allowing PHP ob…KEVEPSS 99%analysed7.8CVE-2017-16651Roundcube Webmail file disclosure via attachment pluginRoundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows an authenticated user to read arbitrary files on the host filesyst…KEVEPSS 46%analysed6.1CVE-2025-68461Roundcube Webmail XSS via SVG animate tagRoundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is vulnerable to cross-site scripting through the animate tag in an SVG document. Because the f…KEVEPSS 27%analysed6.1CVE-2024-37383Roundcube Webmail XSS via SVG animate attributesRoundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 is vulnerable to cross-site scripting through SVG animate attributes. Because the flaw sits in …KEVEPSS 73%analysed6.1CVE-2023-43770Roundcube Webmail XSS via crafted links in plain-text emailsRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 is vulnerable to cross-site scripting because of how rcube_string_replacer.php ha…KEVEPSS 64%analysed

Source: NIST National Vulnerability Database (record CVE-2015-5382), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.