Roundcube Webmail Code Injection Vulnerability in LDAP Autovalues Option

A code injection vulnerability has been identified in Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. The issue arises from insecure code evaluation logic in the LDAP autovalues option, which could be exploited to inject malicious code. In versions 1.6.16 and 1.7.1, support for code evaluation in this context has been removed.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server where Roundcube is hosted.

Remediation

Users are advised to update to Roundcube Webmail versions 1.6.16 or 1.7.1. Instructions for downloading these versions are available on the Roundcube GitHub releases page.