CVE-2021-44026

Roundcube Webmail contains a SQL injection flaw (CWE-89) in which attacker-controlled 'search' or 'search_params' input is incorporated into database queries without sufficient sanitization. An attacker with access to the webmail search functionality (typically an authenticated mailbox user) can submit crafted parameters to execute arbitrary SQL against the Roundcube backend database, potentially reading or modifying stored mail account data. Any organization running Roundcube is affected, including self-hosted mail servers and customers of hosting providers that ship Roundcube as their bundled webmail client. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2023-06-22, indicating exploitation in the wild, and EPSS assigns a 41.9% probability of exploitation within 30 days (99th percentile). No public proof-of-concept is known, and CISA lists ransomware use as unknown.

What to do: Apply vendor updates per Roundcube's instructions by upgrading to the latest patched, supported release, prioritizing internet-facing webmail servers; federal agencies must remediate per the CISA KEV requirement. If Roundcube is managed by a hosting provider (e.g., via cPanel), coordinate patching with them. In the interim, restrict webmail exposure and review database and web logs for anomalous search-related queries that may indicate exploitation.