Roundcube Webmail Arbitrary File Deletion Vulnerability via Session Poisoning Bypass

A vulnerability allowing pre-authentication arbitrary file deletion has been identified in Roundcube Webmail versions 1.6.x prior to 1.6.16 and 1.7.x prior to 1.7.1. This issue arises from a session poisoning bypass that exploits Redis or Memcache sessions.

Impact

Exploitation of this vulnerability allows for unauthorized deletion of files on the server where Roundcube is hosted.

Remediation

Users are advised to update to Roundcube Webmail versions 1.6.16 or 1.7.1. Instructions for downloading these versions are available on the Roundcube GitHub releases page.