Description

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privilege escalation.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T13:16:55.410Z",
  "pubdate": "2026-08-17T13:16:55.410Z",
  "executiveSummary": "An LDAP search filter injection vulnerability has been identified in Roundcube Webmail before version 1.6.18 and version 1.7.x before 1.7.3. This vulnerability stems from improper sanitization and handling of substitution parameters within LDAP query construction. Specifically, the flaw allows unescaped substitution of %u, %fu, and %d variables, exposing the underlying LDAP query mechanism to manipulation by malicious inputs.\nThe primary impact of this vulnerability includes potential unauthorized information disclosure and privilege escalation within the affected messaging environment. An attacker capable of interacting with the vulnerable application features can craft specialized input sequences that alter the logic of the constructed LDAP search filter. This manipulation enables unauthorized retrieval of sensitive directory attributes or traversal of directory structures beyond the user's intended scope.\nAffected systems comprise Roundcube Webmail installations utilizing vulnerable codebases across the specified version ranges. The risk implications are significant for organizations relying on tightly integrated directory services for user authentication and authorization mapping. Exploitation generally requires the ability to supply input that gets processed into the LDAP search query, potentially under standard application interaction flows without requiring elevated privileges depending on the exact integration point.\nMitigation requires upgrading the Roundcube Webmail deployment to the patched releases (1.6.18, 1.7.3, or later) where proper input escaping and substitution handling for LDAP queries are enforced. Administrators should monitor for anomalous LDAP query patterns and restrict directory service permissions associated with the webmail application to adhere to the principle of least privilege.",
  "technicalDetails": "The vulnerability resides within the LDAP search functionality of Roundcube Webmail, specifically in how dynamic substitution variables (%u, %fu, and %d) are handled when constructing LDAP search filters. The root cause is insufficient input sanitization and a lack of proper escaping mechanisms for special LDAP filter characters before string interpolation occurs in the query generation logic.\nThe vulnerable component involves the internal LDAP abstraction or query construction modules responsible for interacting with directory servers. Affected software versions include all Roundcube Webmail installations prior to 1.6.18 and versions in the 1.7.x branch prior to 1.7.3. The flaw manifests when user-supplied data or context variables containing special control characters or boolean operators are mapped directly into the substitution specifiers without neutralizing syntax-breaking characters such as parentheses, asterisks, or logical operators.\nExploitation occurs step-by-step as follows. First, the attacker identifies an input vector or application feature that triggers an LDAP search operation utilizing the vulnerable substitution patterns (%u, %fu, or %d). Second, the attacker crafts a malicious payload containing LDAP filter syntax characters designed to prematurely close existing filter clauses and introduce new conditional expressions. Third, the application interpolates the unescaped payload into the target LDAP search filter string. Fourth, the resulting malformed or expanded query is executed against the backend directory server.\nBecause the input modifies the query logic, the directory server evaluates the injected filter constraints, returning unauthorized data sets or altering the authorization context. Post-exploitation impact encompasses information disclosure, allowing unauthorized actors to harvest directory attributes, user details, or internal structures, which can subsequently facilitate privilege escalation or secondary attacks against the infrastructure."
}