---
title: "Roundcube SQLi (CVE-2021-44026)"
canonical: https://trickest.com/library/cve-2021-44026-roundcube-sqli
description: "Flag Roundcube Webmail hosts for CVE-2021-44026 by reading the version on /?_task=login. Floors 1.3.17 and 1.4.12. No SQLi payload."
---

# Roundcube SQLi (CVE-2021-44026)

## Overview

This workflow finds Roundcube Webmail and sorts each host by whether its version falls below the CVE-2021-44026 fixed floors. CVE-2021-44026 is SQL injection through Roundcube search parameters. This check never sends a search query and never injects SQL. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/?_task=login`, fingerprints Roundcube from page markers, reads the version from the login page, and compares it to the per-branch table in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Hosts that hide their version stay product-detected without a vulnerable flag.

Run it on a schedule when webmail frontends change. A forgotten Roundcube 1.4.x box is the reason the same fingerprint is worth more the second week than the first.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/?_task=login` on each host and fingerprint Roundcube from markers such as `Roundcube`, `rcmail`, and the generator meta tag.
3. Parse the version from the login page and compare it to the CVE-2021-44026 per-branch floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Roundcube was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/?_task=login` only. No SQL injection payload and no CHANGELOG fetch.

## Sample output

The records below are illustrative and do not come from a real run. They show one Roundcube host below a branch floor, one at or above its floor, and one host that is not the product.

```jsonl
{"url": "https://mail.example.com", "is_product": true, "product_version": "1.4.11", "vulnerable": true, "detail": "below branch floor 1.4.12"}
{"url": "https://mail.example.org", "is_product": true, "product_version": "1.4.12", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Roundcube Webmail"}
```

```json
{"cve": "CVE-2021-44026", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Roundcube versions does this flag?

Builds below the per-branch floors in the graph: 1.3.17 on the 1.3.x line and 1.4.12 on the 1.4.x line. 1.5.0 and later are treated as fixed. The compare uses the version the login page itself served.

### Does an affected row mean SQL injection worked?

No. The check only GETs `/?_task=login` and reads the version. It does not send a search parameter and it does not confirm SQLi.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public login page. It does not log in or touch the mailbox database.

### Does the check need credentials?

No. It fingerprints the public login page the way an external scanner would.

### What is CVE-2021-44026?

SQL injection in Roundcube Webmail through search parameters. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Roundcube ImageMagick RCE (CVE-2020-12641)](/library/cve-2020-12641-roundcube-imagemagick-rce). Reach for it when you need the earlier ImageMagick RCE fingerprint.
- [Roundcube RCE (CVE-2025-49113)](/library/roundcube-rce-check-cve-2025-49113). Reach for it when you need a later Roundcube RCE exposure check.

---
_Markdown source of https://trickest.com/library/cve-2021-44026-roundcube-sqli._