CVE-2005-4368: Roundcube Webmail

Medium severity, CVSS 5.0. EPSS: 1.4% chance of exploitation in the next 30 days.

roundcube webmail Alpha, with a default high verbose level ($rcmail_config['debug_level'] = 1), allows remote attackers to obtain the full path of the application via an invalid_task parameter, which leaks the path in an error message.

Affected products

• Roundcube Webmail: affected versions not specified

Published 2005-12-20. Last modified 2026-06-16.