CVE-2021-44026
Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Jun 22, 2023
- US federal agencies must remediate it by Jul 13, 2023 (BOD 22-01)
- First attack observed 578 days after disclosure
Apply updates per vendor instructions.
Source: CISA KEV · Oct 9, 2025 May 22, 2025 May 21, 2025 Jan 25, 2025 Jul 29, 2024 May 29, 2024
CVSS score9.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-89, CWE-89
Vendorsdebian, fedoraproject, roundcube
Affected products
| Vendors | Product | Versions |
|---|---|---|
| roundcube | webmail | < 1.3.17 |
| fedoraproject | fedora | 33 |
| debian | debian linux | 9.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.