Vulnerability record · CVE-2017-16651 · published 9 November 2017
CVE-2017-16651: Roundcube Webmail file disclosure via attachment plugin
Roundcube · Webmail
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows an authenticated user to read arbitrary files on the host filesystem, including configuration files. The flaw is tied to file-based attachment plugins and crafted _task=settings&_action=upload-display&_from=timezone requests. It matters because exposed configuration files can leak credentials and secrets that enable further compromise.
Description
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is in CISA KEV with confirmed in-the-wild exploitation and a high EPSS percentile, though it requires valid credentials, which limits exposure.
What it is
Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows an authenticated user to read arbitrary files on the host filesystem, including configuration files. The flaw is tied to file-based attachment plugins and crafted _task=settings&_action=upload-display&_from=timezone requests. It matters because exposed configuration files can leak credentials and secrets that enable further compromise.
Impact
An attacker with a valid account gains read access to arbitrary host files, including Roundcube configuration containing database and mail credentials. That access can be used to pivot into backend systems and other accounts.
Attack surface
Reached through the Roundcube web interface by an authenticated user with a valid username and password; the description states an active session is required. No user interaction beyond the attacker's own authenticated requests is indicated.
Exploitation
CISA added it to KEV on 2021-11-03, and EPSS shows a 30-day probability of 0.36919 (98.4th percentile). References include an Exploit-tagged Packet Storm entry, and the description states it was exploited in the wild in November 2017.
What to do
- Upgrade Roundcube to 1.1.10, 1.2.7, or 1.3.3 or later as applicable, or apply the vendor patch referenced in issue 6026.
- Apply the Debian security update DSA-4030 for packaged installations.
- Restrict and review Roundcube configuration file permissions and rotate any credentials those files contain.
- Limit webmail account provisioning and monitor for unexpected authenticated access to settings/upload-display endpoints.
Detection
- Search web server logs for requests to _task=settings&_action=upload-display with _from=timezone parameters.
- Alert on authenticated sessions reading files outside expected webmail paths or accessing configuration files.
- Monitor for anomalous access to Roundcube config files and subsequent authentication attempts using leaked credentials.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2017-16651 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Roundcube Webmail File Disclosure Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2017-16651 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-16651), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
