Roundcube Webmail (versions below 1.6.16 and 1.7.1)

The virtuser_query plugin resolves email addresses to mailbox usernames. It tries to block SQL injection using a backslash-escaping filter on the preg_replace() function. The flaw exists because specially crafted backslash sequences in attacker input defeat the filter entirely, allowing quote characters to reach the underlying SQL query unmodified. The database then executes whatever the attacker appended.

An unauthenticated attacker sends a crafted request to the Roundcube server that targets the virtuser_query plugin. The malicious input traverses the broken filter and injects SQL commands directly into a query sent to the database. From there, the attacker can read user emails, address books, and identity data, tamper with database records, and map out authentication and admin workflows — all without a valid login.

1. Check your mail server logs for unusual query patterns targeting the virtuser_query plugin, particularly requests containing backslash sequences in email address fields.
2. Look for unexpected database read operations on user identity and message tables outside of normal login windows.
3. Monitor for new or anomalous admin-level activity in Roundcube's database, which may indicate an attacker is mapping authentication functions.

1. Upgrade to Roundcube 1.6.16 or 1.7.1 immediately — patches have been available since late May.
2. If you cannot patch immediately, disable the virtuser_query plugin as a temporary mitigation.
3. Audit access logs for suspicious requests and restrict external access to the Roundcube admin interface.