Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Roundcube: Authenticated users can read arbitrary files

CVE-2015-8794 · published 10 years ago
Summary

A security issue in Roundcube's photo handling allows authenticated users to access files they shouldn't be able to see. This could happen if a user enters a full path to a file in the photo upload process. To fix this, update to Roundcube 1.0.6 or 1.1.2 or later.

What to do
  • Update debian roundcube to version 1.1.2+dfsg.1-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:11 debian roundcube < 1.1.2+dfsg.1-1
Fix: upgrade to 1.1.2+dfsg.1-1
Debian:12 debian roundcube < 1.1.2+dfsg.1-1
Fix: upgrade to 1.1.2+dfsg.1-1
Debian:13 debian roundcube < 1.1.2+dfsg.1-1
Fix: upgrade to 1.1.2+dfsg.1-1
Debian:14 debian roundcube < 1.1.2+dfsg.1-1
Fix: upgrade to 1.1.2+dfsg.1-1
– roundcube roundcube_webmail <= 1.0.5
1.1.0
1.1.1
cpe:2.3:a:roundcube:roundcube_webmail:*:*:*:*:*:*:*:*
Original advisory text
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pa...
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the _alt parameter, related to contact photo handling.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
6.5 Medium
Exploitation
2% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published29 Jan 2016
Updated4 Nov 2026
First seen29 May 2026
Sources
DEBIAN-CVE-2015-8794 · OSV
CVE-2015-8794 · NVD
Track software like this
Free during beta