CVE-2015-8770
High · 7.5CVSS
7.5
EPSS
22.4%
Published
Jan 29, 2016
CISA due date
—
The record
Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated users with certain permissions to read arbitrary files or possibly execute arbitrary code via a .. (dot dot) in the _skin parameter to index.php.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | roundcube | 0 | 1.1.4+dfsg.1-1 |
| Debian:12 | roundcube | 0 | 1.1.4+dfsg.1-1 |
| Debian:13 | roundcube | 0 | 1.1.4+dfsg.1-1 |
| Debian:6.0 | roundcube | 0 | 0.3.1-6+deb6u1 |
| Debian:7 | roundcube | 0 | 0.7.2-9+deb7u2 |
| Ubuntu:16.04:LTS | roundcube | 0 | 1.1.4+dfsg.1-1 |
| Ubuntu:18.04:LTS | roundcube | 0 | 1.3.6+dfsg.1-1 |
| openSUSE:Tumbleweed | roundcubemail | 0 | 1.2.3-1.1 |
Related vulnerabilities
- CVE-2025-49113 Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by… Also affects roundcube
- CVE-2024-57004 Cross-Site Scripting (XSS) vulnerability in Roundcube Webmail 1.6.9 allows remote… Also affects roundcube
- CVE-2024-42010 mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters… Also affects roundcube
- CVE-2017-16651 Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows… Also affects roundcube
- CVE-2008-5619 html2text.php in Chuggnutt HTML to Text Converter, as used in PHPMailer before 5.2.10… Also affects roundcube
- CVE-2026-48847 Roundcube Webmail 1.6.x before 1.6.16, and 1.7.x before 1.7.1 allows pre-authentication… Also affects roundcubemail
- CVE-2026-48846 In Roundcube Webmail 1.6.x before 1.6.16 and 1.7.x before 1.7.1, the remote image… Also affects roundcubemail
- CVE-2026-48845 In Roundcube Webmail 1.6.x between 1.6.14 and 1.6.16 and 1.7.x before 1.7.1, remote image… Also affects roundcubemail