CVE-2015-5382: program/steps/addressbook/photo.inc in Roundcube Webmail before 1.0.6 and 1.1.x before 1.1.2 allows remote...

Security readout for executives and security teams

CVE-2015-5382 affects older Roundcube Webmail releases. A logged-in user could abuse vCard photo handling to read files on the server that the webmail process can access. This is not listed as known exploited, but it matters for internet-facing webmail because server files may contain configuration, mail, or credentials. Exposure is most likely where Roundcube Webmail is deployed, reachable by users, and still running before 1.0.6 or 1.1.2. The flaw requires authentication, so compromised mailbox accounts or low-privileged users increase practical risk. Prioritize remediation for internet-facing Roundcube systems, especially shared or high-value mail environments. The issue is authenticated and not known exploited from the provided sources, but arbitrary file read can expose secrets that support further compromise. Mitigation focus: Upgrade Roundcube to 1.0.6, 1.1.2, or a later supported release.; Check Roundcube vendor guidance for any branch-specific upgrade notes.; Restrict webmail access to trusted networks where feasible..

Prepared

Jun 13, 2026, 05:01 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.