Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

roundcube/roundcubemail

              master @ 752eeba
            

216

Fixes

CVEs

CRITICAL

Peak severity

26.5%

Coverage

Highlights

Reflected XSS: 43 prior fixes. Scrutinize any change in this area.

program/lib/Roundcube/rcube_washtml.php: most-fixed (33 issues). Treat as high-risk during review.

89 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Cross-Site Scripting (XSS): Attackers frequently bypass the HTML/SVG message sanitizer by utilizing nested tag structures, malformed XML namespaces, and style/CSS injections to execute arbitrary scripts when a victim opens a crafted email.

Auth Bypass: Loose session variables, unhandled hashing failures, and dynamic type comparisons inside password change drivers permitted attackers to modify other users' passwords or bypass restrictions.

Command Injection: Using shell executables for image converting or thumbnail processing allowed command injection if argument validation was avoided or bypassed on specific operating systems like Windows.