CVE-2015-8770

CVE-2015-8770 describes a directory traversal vulnerability in Roundcube webmail versions before 1.0.8 and 1.1.x before 1.1.4. This flaw allows remote authenticated users with specific permissions to read arbitrary files or potentially execute arbitrary code by manipulating the _skin parameter. Rated with a CVSS score of 7.5 (HIGH), it has a network attack vector and high impact on confidentiality, integrity, and availability, though it requires high attack complexity. While not listed on the KEV catalog or Hot List, an exploit is publicly available on ExploitDB, but there is no evidence of active exploitation or significant community discussion.