Roundcube
Mail · products/roundcube.yaml · RSS
Latest 1.7.5 Oct 19, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 1.7 | 1.7.5 | May 10, 2026 | — · maintained |
| 1.6 LTS | 1.6.20 | Jul 25, 2022 | — · maintained |
| 1.5 LTS | 1.5.15 | Oct 18, 2021 | May 10, 2026 · ended |
| 1.4 | 1.4.15 | Nov 9, 2019 | Dec 10, 2023 · ended |
| 1.3 | 1.3.17 | Jun 26, 2017 | Jul 28, 2022 · ended |
| 1.2 | 1.2.13 | May 21, 2016 | Oct 18, 2021 · ended |
| 1.1 | 1.1.12 | Feb 7, 2015 | — · ended |
| 1.0 | 1.0.12 | Apr 5, 2014 | — · ended |
Recent releases
securityFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
securityFix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy
securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
securityFix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
securityFix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
securityFix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
breakingDropped support for PHP < 8.1.
breakingDropped support for Internet Explorer.
breakingDropped support for MS SQL Server and Oracle.
securityFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
securityFix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy
securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
securityFix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
securityFix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
securityFix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
securityFix XSS issue in a HTML attachment preview, reported by aikido_security.
securityFix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
securityFix CSS injection vulnerability reported by CERT Polska.
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
securityRemove X-XSS-Protection example from .htaccess file (#9875)
Security advisories
No advisories in the feed yet.