CVE-2017-16651

Roundcube Webmail fails to adequately validate input handled alongside file-based attachment plugins, which are used by default, allowing an attacker to manipulate the file path held for an attachment and make the server read arbitrary files from the host. The flaw is triggered through crafted requests to Roundcube's attachment handling, where insufficient path validation permits traversal or absolute-path file reads. A successful attacker gains the ability to read files with the privileges of the web server user, which can expose sensitive data such as Roundcube's configuration (including database and IMAP credentials) and other files on the mail server. Any Roundcube deployment relying on the default file-based attachment handling is affected, a footprint that spans bundled hosting-provider webmail as well as standalone installations. CISA added CVE-2017-16651 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, and EPSS ranks it in the 98th percentile with roughly a 37% chance of exploitation within 30 days.

What to do: Apply the vendor's patched Roundcube release per CISA's required action; this flaw was fixed in the 2017 security updates for each active branch (1.1.10, 1.2.7, and 1.3.4 or later). Until patched, disable or avoid file-based attachment plugins (such as the filesystem attachment driver) and review web server logs for suspicious attachment-path requests or unexpected file access. Because arbitrary file reads can disclose Roundcube configuration secrets, rotate database/IMAP credentials stored in the webmail configuration and check for follow-on compromise.