poste.io

Latest 2.5.20 Oct 21, 2026

Recent releases

2.5.20 Oct 21, 2026 Release notes ↗ 1security

securitysecurity upgrade to PHP 8.2.35

securityRoundcube 1.7.4 (webmail database is migrated on first start, no way back to 1.6)

securitywebmail serves only the Roundcube entry points

2.5.17 Sep 18, 2026 → 2.5.20 Release notes ↗ 1security1fix1feature

securityRoundcube 1.6.19

2.5.15 Aug 20, 2026 → 2.5.20 Release notes ↗ 5security4fix1feature

securitysecurity: add CSRF protection to state-changing log/dkim/filter/quarantine actions

securitysecurity: enforce log tenant scoping structurally, not via query string

securitysecurity: require current password for self-service password change

securityRoundcube 1.6.17

2.5.13 Jun 26, 2026 → 2.5.20 Release notes ↗ 1feature3security

securityRoundcube 1.6.16

securitysecurity: fix SRS using a predictable secret (could allow SRS address forgery and mail relay)

securitysecurity: harden mailserver helpers against shell command injection

securityfix #1198 add GID limits for Dovecot configuration

securityfix Dovecot auth cache rollback

securityRoundcube 1.6.15

securityfix Dovecot password caching, try no 2

securityRoundcube 1.6.14

securityfix Dovecot password caching

securityfix Dovecot repository download

2.5.9 Feb 13, 2026 → 2.5.20 Release notes ↗ 5security1feature1fix

securityRoundcube 1.6.13

securityadd Dovecot high-performance mode configuration

securityadd Dovecot service status to server status page

2.5.8 Dec 24, 2025 → 2.5.20 Release notes ↗ 1security8fix1feature

securityRoundcube 1.6.12

breakingremoved hardcoded list of locales

Security data is not available for this product.