CVE-2021-44026

Roundcube webmail versions before 1.3.17 and 1.4.12 have a flaw in the search feature that allows attackers to inject malicious SQL commands. This could let an attacker steal emails, passwords, or other sensitive data from the mail server.

SQL injection vulnerability in Roundcube's search and search_params functionality allows unauthenticated or authenticated attackers to execute arbitrary SQL queries against the backend database. The attack vector leverages improper input sanitization in search parameters, potentially leading to data exfiltration, authentication bypass, or database manipulation.