{"id":"CVE-2017-16651","published":"2017-11-09T14:29:00Z","modified":"2026-06-17T01:09:37Z","title":"Roundcube Webmail File Disclosure Vulnerability","vendor":"Roundcube","product":"Roundcube Webmail","tier":"core","eol":null,"description":{"text":"Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests.","provenance":"source","from":"NVD"},"summary":{"text":"Roundcube Webmail's file-based attachment plugins contain a flaw in how requests to the settings upload-display handler (_task=settings&_action=upload-display&_from=timezone) are processed, affecting versions before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3. An attacker who holds a valid username and password for the target and an active session can read arbitrary files from the host's filesystem, including configuration files, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:10:56Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.45742,"percentile":0.98794,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2021-11-03","dueDate":"2022-05-03","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","provenance":"source"},"vulncheckKev":{"dateAdded":"2017-11-08","exploitedFirstSeen":"2017-11-08","ransomware":false,"evidence":[{"url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","date":"2017-11-08"},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-16651","date":"2017-11-09"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2021-11-03"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-552","name":"Files or Directories Accessible to External Parties"}],"references":[{"url":"http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/101793","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/roundcube/roundcubemail/issues/6026","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.1.10","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.2.7","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.3.3","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4030","tags":["Issue Tracking","Third Party Advisory"]},{"url":"http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/bid/101793","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://github.com/roundcube/roundcubemail/issues/6026","tags":["Issue Tracking","Patch","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.1.10","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.2.7","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.3.3","tags":["Issue Tracking","Release Notes","Third Party Advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2017/11/msg00039.html","tags":["Mailing List","Third Party Advisory"]},{"url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","tags":["Issue Tracking","Vendor Advisory"]},{"url":"https://www.debian.org/security/2017/dsa-4030","tags":["Issue Tracking","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-16651","tags":["US Government Resource"]}],"techniques":[{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve","ai-mapping"],"basisDetail":"CTID attack_to_cve (Phase 1); claude-haiku-5-5: Reads arbitrary files from host filesystem","mappingType":"uncategorized","evidence":[{"from":"description","quote":"allows unauthorized access to arbitrary files on the host's filesystem, including configuration files","start":76,"end":177}],"confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-cve","bases":["ctid-cve"],"basisDetail":"CTID attack_to_cve (Phase 1)","mappingType":"uncategorized","evidence":[],"confidence":"low","confidenceNote":"CTID attack_to_cve Phase 1 \"Uncategorized\" mapping (not staged by impact)"},{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Requires valid authenticated session credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"The attacker must be able to authenticate at the target system with a valid username/password","start":222,"end":315}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2017-7838","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7838","exploited":true,"exploitedSince":"2021-11-03","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2021-01-06","earliestUrl":"https://github.com/ropbear/CVE-2017-16651","repos":[{"name":"ropbear/CVE-2017-16651","url":"https://github.com/ropbear/CVE-2017-16651","stars":3,"created":"2021-01-06"}]},"metasploit":[{"name":"Roundcube TimeZone Authenticated File Disclosure","module":"auxiliary/gather/roundcube_auth_file_read","type":"auxiliary","disclosureDate":"2017-11-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb"}],"first":{"date":"2017-11-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/161226/Roundcube-Webmail-1.2-File-Disclosure.html"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"related","techniques":["T1005"],"provenance":"source"},{"stage":"related","techniques":["T1190"],"provenance":"source","lowConfidence":true}],"timeline":[{"date":"2017-11-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://roundcube.net/news/2017/11/08/security-updates-1.3.3-1.2.7-and-1.1.10","provenance":"source"},{"date":"2017-11-09","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-16651","provenance":"source"},{"date":"2017-11-09","kind":"exploit-public","label":"First public exploit: Metasploit; later: PoC-in-GitHub 2021-01-06","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/roundcube_auth_file_read.rb","provenance":"source"},{"date":"2021-11-03","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2021-11-03","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2017-7838","provenance":"source"}],"speed":{"daysToPublicExploit":0,"firstExploitFrom":"Metasploit","daysToKev":1455},"priority":{"score":68.2,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 3277 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.76,"detail":"percentile 0.9879"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 PoC-in-GitHub repo; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}