Roundcube security updates 0.8.6 and 0.7.3
Description
Roundcube versions prior to 0.8.6 and 0.7.3 contain a path traversal vulnerability (CWE-22) that allows unauthenticated attackers to read arbitrary files from the server's filesystem. The vulnerability exists in the preferences handling mechanism, specifically related to the 'generic_message_footer' preference setting. Attackers can exploit this flaw by manipulating user preference values to traverse directory structures and access sensitive files outside the intended application directory.
Remediation
Immediately upgrade to Roundcube version 0.8.6, 0.7.3, or later. If immediate upgrading is not possible, apply the appropriate vendor-supplied patch for your version (0.6, 0.7.x, 0.8.x, or 0.9.x) available from the SourceForge downloads page.
After patching or upgrading, verify that no users have been compromised by running the following SQL query against your Roundcube database:
SELECT * FROM users WHERE preferences LIKE '%generic_message_footer%'
If this query returns any results, investigate those user accounts immediately as they may have attempted to exploit the vulnerability. Consider disabling affected accounts, reviewing server logs for unauthorized file access, and conducting a security audit to determine if sensitive files were accessed.