File and Path Handling

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files,…CVE-2017-16651Roundcube · CVSS 7.8 · 46% likely

   CWE-552

2. Directory traversal vulnerability in the set_skin function in program/include/rcmail_output_html.php in Roundcube before 1.0.8 and 1.1.x before 1.1.4 allows remote authenticated u…CVE-2015-8770Roundcube · 22% likely

   CWE-22

3. Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.CVE-2020-12640Roundcube · 6.7% likely

   CWE-22

4. Absolute path traversal vulnerability in steps/mail/sendmail.inc in Roundcube Webmail before 0.7.3 and 0.8.x before 0.8.6 allows remote attackers to read arbitrary files via a ful…CVE-2013-1904Roundcube · 2.3% likely

   CWE-22

5. Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary f…CVE-2015-8794Roundcube · 2.1% likely

   CWE-22

6. Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelmail_usercopy plugin. With the file based backend, the source p…CVE-2026-114714Roundcube · CVSS 5.3 · 0.4% likely

   CWE-23

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.