Cette page suit l'état du correctif pour Debian. La vulnérabilité elle-même est décrite sur la page CVE principale. Voir CVE-2026-74997 →

DEBIAN-CVE-2026-74997

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via craft...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue only affects Roundcube instances using the markasjunk plugin with its cmd_learn driver.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Paquets affectés

Debian:12 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.5+dfsg-1+deb12u11"}]}]

Debian:13 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18+dfsg-0+deb13u1"}]}]

Debian:14 roundcube

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.18+dfsg-1"}]}]

Références

advisory security-tracker.debian.org