CVE-2013-1904

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 0.7.3 Roundcube Webmail versions 0.8.x prior to 0.8.6

Description The issue allows remote attackers to read arbitrary files via a full pathname in the value parameter for the generic message footer setting in a save-perf action to "index.php". This has been exploited in the wild.

Recommendations For versions prior to 0.7.3, update to version 0.7.3 or later. For versions 0.8.x prior to 0.8.6, update to version 0.8.6 or later.