📦 Roundcube

What is it?

Concept: Roundcube is a PHP webmail client — a browser front end that speaks IMAP to a back-end mail server (Dovecot most commonly) and SMTP for sending. It stores no mail of its own; it is a rendering and session layer over somebody else’s mailbox. Its own database holds users, preferences, contacts and session state.
Impact: As a front end its value to an attacker is twofold. It is a login oracle — a browser-friendly place to confirm a recovered mail credential — and it renders attacker-influenced content (message bodies, HTML mail, attachments), which is why its vulnerability history is dominated by XSS in the message renderer.

Roundcube authenticates by attempting an IMAP login with the submitted credentials. There is no separate user store for passwords — a Roundcube login is an IMAP login, so any mail credential works on the web UI and vice versa.
On success it holds the IMAP session server-side and proxies folder listing, message fetch and search through PHP.
Sending goes out over SMTP to a configured relay. If no SMTP service is reachable, composition fails while everything read-only continues to work.
Plugins (managesieve, password, zipdownload, …) extend the UI and are enumerable — the version of each is typically listed in the About dialog alongside the core version.

The About dialog is free version disclosure to any authenticated user — core version and every enabled plugin version, in one screen. It is the first place to look after logging in.
Roundcube’s CVE history clusters in the message renderer. Its job is displaying untrusted HTML, so stored XSS in body/plain-text rendering recurs across versions.
An XSS in webmail is only as useful as your ability to deliver mail. With no SMTP service on the host, a stored-XSS CVE in the renderer is unexploitable — the payload cannot be placed in another user’s mailbox. Confirming there is no port 25 retires that entire branch before any time is spent on it, which is exactly what happened on HTB Machine - Enigma with CVE-2026-54433.
Credential equivalence cuts both ways: a password sprayed successfully against imaps:// logs straight into the web UI, and the web UI gives a friendlier read of the same mailbox than raw IMAP commands.
Failed logins on the web form are indistinguishable from failed IMAP logins, because they are the same event — so web-form brute forcing is slower than going at 993 directly, with no additional information gained.
Roundcube is commonly reached through a dedicated vhost (mail., webmail., mail001.) rather than the main site, which makes vhost fuzzing the usual way it surfaces.

Check for SMTP before researching any Roundcube CVE. It determines whether half the published attack surface applies at all.
Once inside, the highest-yield reading order is Sent, then Drafts, then Inbox — outbound mail is where users type credentials themselves.
The underlying mailbox is faster to work with over raw IMAP; see IMAP - Mailbox Enumeration. Use the web UI to confirm access, the shell to loot.

Fix: Keep Roundcube and its plugins patched — the renderer XSS class is fixed promptly upstream and is the dominant real risk.
Set a strict Content-Security-Policy so an XSS in a rendered message body cannot exfiltrate the session.
Do not expose webmail to the internet without MFA in front of it; the login form is a direct oracle for mail-credential guessing.
Remove unused plugins rather than leaving them enabled and unpatched.

File	Created
HTB Machine - Enigma	September 07, 2026

References: