Roundcube Webmail SQL Injection Vulnerability

CRITICAL 9.8EXPLOITED (CISA KEV)CVE-2021-44026 · Published 19/11/2021 · updated 17/06/2026

Roundcube Webmail SQL Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 22/06/2023. Patch affected systems as an emergency.

In short

CVE-2021-44026 is a CRITICAL (CVSS 9.8) vulnerability affecting webmail (roundcube).
Exploited in the wild: CISA added it to the KEV catalog on 22/06/2023.
Chance of exploitation in the next 30 days (EPSS): 69.9%, higher than 99.4% of all vulnerabilities.
Fix: update to 1.4.12, 1.3.17 or later.

Package	Affected versions	Patched versions
webmail roundcube	`≥ 1.4.0, < 1.4.12< 1.3.17`	`1.4.121.3.17`

Description

Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.

References

bugs.debian.org/1000156 · Mailing List
roundcube/roundcubemail commit c8947ec · Patch
roundcube/roundcubemail commit ee809bd · Patch
lists.debian.org/debian-lts-announce/2021/12/msg00004.html · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NDVGIZMQJ5IOM47Y3SAAJRN5VPANKTKO · Mailing List
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TP3Y5RXTUUOUODNG7HFEKWYNIPIT2NL4 · Mailing List
debian.org/security/2021/dsa-5013 · Third Party Advisory
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-44026

More vulnerabilities in webmail

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

webmail

roundcube

≥ 1.4.0, < 1.4.12< 1.3.17

1.4.121.3.17

More vulnerabilities in webmail

See all →