Is CVE-2026-114714 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114714 being exploited in the wild.

How severe is CVE-2026-114714?

Medium severity, with a CVSS score of 5.3, published 22 October 2026.

Which products and versions are affected?

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5.

Is there a fix for CVE-2026-114714?

Yes: fixed in 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-114714 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-114714?

Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114714: Roundcube Webmail path traversal in squirrelmail_usercopy plugin

CVE-2026-114714 · Severity: medium · CVSS 5.3 · Published 2026-10-22

Roundcube Webmail is an open-source email client that users access through a web browser. A path traversal flaw in the squirrelmail_usercopy plugin allows an attacker with a crafted login name to read arbitrary files outside the intended data directory and import them into the mail system, potentially exposing sensitive configuration files or user data.

Technologies: Roundcube Webmail. Vendors: Roundcube.

Quick answers

Is CVE-2026-114714 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114714 being exploited in the wild.
How severe is CVE-2026-114714?: Medium severity, with a CVSS score of 5.3, published 22 October 2026.
Which products and versions are affected?: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5.
Is there a fix for CVE-2026-114714?: Yes: fixed in 1.6.20, 1.7.5. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114714 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-114714?: Check whether you run Roundcube Webmail at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.6.20, 1.7.5

Technical details

The squirrelmail_usercopy plugin constructs file paths from the login name without validating for path separators, allowing an attacker to inject directory traversal sequences (e.g., a login name containing slashes) to read files outside squirrelmail_data_dir. The vulnerability requires the file-based backend configuration and the ability to provide a malicious login name. The fix rejects login names containing forward slashes.

Affected products

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5

Timeline

2026-10-22: disclosed
2026-10-19: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.