Roundcube 1.2.6 → 1.6.19

77 releases · 39 breaking changes · 275 security fixes · 39 advisories fixed

275security39breaking4deprecated37feature526fix

Is 1.2.6 affected? · What changed up to 1.7.5

Vulnerabilities fixed by this upgrade

7.2 CVE-2026-54433 In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the…
4.2 CVE-2026-35541 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowin…
5.3 CVE-2026-35542 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. T…
5.3 CVE-2026-35543 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lea…
5.3 CVE-2026-35544 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to a fixed-position mitigation bypass…
5.3 CVE-2026-35545 An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosur…
3.1 CVE-2026-35538 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.
6.1 CVE-2026-35539 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.
3.7 CVE-2026-35537 An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated at…
7.2 CVE-2025-68461KEV Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.
7.2 CVE-2025-68460 Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.
9.9 CVE-2025-49113KEV Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.…
9.3 CVE-2024-42008 A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a maliciou…
9.3 CVE-2024-42009KEV A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desa…
6.1 CVE-2024-37383KEV Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.
6.1 CVE-2024-37384 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.
9.8 CVE-2024-37385 Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020…
6.1 CVE-2023-5631KEV Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behav…
6.1 CVE-2023-43770KEV Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.
9.8 CVE-2021-44026KEV Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params.
6.1 CVE-2021-44025 Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message.
5.4 CVE-2020-18671 Cross Site Scripting (XSS) vulnerability in Roundcube Mail <=1.4.4 via smtp config in /installer/test.php.
5.4 CVE-2021-26925 Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering.
6.1 CVE-2020-35730KEV An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mail message, with JavaScript in a link reference…
6.1 CVE-2020-16145 Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15.
6.1 CVE-2020-15562 An issue was discovered in Roundcube Webmail before 1.2.11, 1.3.x before 1.3.14, and 1.4.x before 1.4.7. It allows XSS via a crafted HTML e-mail message, as demonstrated by a JavaScript payload in…
6.1 CVE-2020-13964 An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object.
6.1 CVE-2020-13965KEV An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview.
9.8 CVE-2020-12640 Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php.
9.8 CVE-2020-12641KEV rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path.
6.1 CVE-2020-12625 An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message.
6.5 CVE-2020-12626 An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered.
7.4 CVE-2019-15237 Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks.
4.3 CVE-2019-10740 In Roundcube Webmail before 1.3.10, an attacker in possession of S/MIME or PGP encrypted emails can wrap them as sub-parts within a crafted multipart email. The encrypted part(s) can further be hid…
7.5 CVE-2018-19205 Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated…
6.1 CVE-2018-19206 steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment.
8.8 CVE-2018-9846 In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_…
7.5 CVE-2018-1000071 roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via netw…
7.8 CVE-2017-16651KEV Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in th…

Breaking changes

breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11
breaking Fix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257) in 1.6.6
breaking Password: Remove references to %c variable that has been removed before (#8633) in 1.6.1
breaking Fix bug where renamed options were removed from the config on installto.sh (update.sh) run (#8643) in 1.6.1
breaking Dropped support for PHP < 7.3 in 1.6.0
breaking Removed the Classic and Larry skins from the release packages in 1.6.0
breaking IMAP: in 1.6.0
breaking renamed default_host to imap_host in 1.6.0
breaking removed default_port option (non-standard port can be set via imap_host) in 1.6.0
breaking set "localhost:143" as a default for imap_host in 1.6.0
breaking SMTP: in 1.6.0
breaking renamed smtp_server to smtp_host in 1.6.0
breaking removed smtp_port option (non-standard port can be set via smtp_host) in 1.6.0
breaking set "localhost:587" as a default for smtp_host in 1.6.0
breaking LDAP: in 1.6.0
breaking removed port option from ldap_public array (non-standard port can be set via host) in 1.6.0
breaking removed use_tls option from ldap_public array (use tls:// prefix in host) in 1.6.0
breaking Managesieve: in 1.6.0
breaking removed managesieve_port option (non-standard port can be set via managesieve_host) in 1.6.0
breaking removed managesieve_usetls option (set tls:// prefix to managesieve_host) in 1.6.0
breaking Fix PHP Fatal error on incompatible method declaration of rcmail_output_json::command() and rcmail_output::command() (#8579) in 1.6.0
breaking ### new defaults for smtp_* config options: Upon many requests and in order to get closer to the default setup of most SMTP servers, we changed the defaults as follows: // SMTP port (default is 587) $config['smtp_port'] = 587; // SMTP username (if required). %u will use the current username for… in 1.4.1
breaking ### changed default password_charset to UTF-8: Because of many complaints, we decided to choose a more sane default that covers most setups and configurations. in 1.4.1
breaking ### login page returning 401 Unauthorized status: The new behavior that Roundcube 1.4 returns a 401 status code if the client is not authenticated apparently was very unexpected and lead to monitoring problems. Despite not having mentioned that change in the release notes, we now partly reverted… in 1.4.1
breaking Remove non-printable characters from filenames on download/display (#5880) in 1.3.1
breaking Bring back double-click behavior on the message list which was removed in 1.3.0 (#5823) in 1.3.1
breaking Dropped support for legacy browsers (IE < 10; removed legacy_browser plugin) in 1.3.0
breaking Removed PHP mail() support in 1.3.0
breaking Removed 3rd party javascript libraries from repo in 1.3.0
breaking Require jQuery 3.x which has breaking changes to older versions in 1.3.0
breaking no longer supports IE < 10 and old versions of Firefox, Chrome and Safari in 1.3.0
breaking Removed useless 'created' column from 'session' table (#5389) in 1.3.0
breaking Removed legacy_browser plugin in 1.3.0
breaking Removed hacks for IE < 10 in 1.3.0
breaking Remove backward compatibility "layer" of bc.php (#4902) in 1.3.0
breaking Remove PHP mail() support, smtp_server is required now (#5340) in 1.3.0
breaking Removed redundant 'created' column from cache and cache_shared tables in 1.3.0
breaking Removed use of redundant data records in 1.3.0
breaking Fix missing message-htmlpart1 class breaking inline CSS (#6493) in 1.2.10

Security changes

security Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko in 1.6.19
security Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers in 1.6.19
security Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy in 1.6.19
security Security: Fix CSS declaration smuggling via un-encoded ampersand emission in 1.6.19
security Security: Fix CSS property injection via body background attribute in 1.6.19
security Security: Fix email header injection via bare CR in the subject field in 1.6.19
security Security: Fix email header injection via C-escape \r in the recipient display name in 1.6.19
security Security: Fix email header injection via identity's organization field in 1.6.19
security Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL in 1.6.19
security Security: Fix XSS in the HTML editor using text/enriched part content in 1.6.19
security Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book in 1.6.19
security Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL in 1.6.19
security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes in 1.6.19
security Security: Fix remote-content blocker bypass via SVG SMIL src animation in 1.6.19
security Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses in 1.6.19
security Fixes CVE-2026-74997: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue o… in 1.6.18
security Fixes CVE-2026-74998: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site sc… in 1.6.18
security Fixes CVE-2026-75002: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command inject… in 1.6.18
security Fixes CVE-2026-75010: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data… in 1.6.18
security Fixes CVE-2026-75006: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styles… in 1.6.18
security Fixes CVE-2026-75000: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to infor… in 1.6.18
security Fixes CVE-2026-75003: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure o… in 1.6.18
security Fixes CVE-2026-75007: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privileg… in 1.6.18
security Fixes CVE-2026-74999: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. in 1.6.18
security Fixes CVE-2026-75004: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue… in 1.6.18
security Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko in 1.6.18
security Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe in 1.6.18
security Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 in 1.6.18
security Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai in 1.6.18
security Security: Add basic validation for content proxied by the css proxy in 1.6.18
security Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets in 1.6.18
security Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check in 1.6.18
security Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute in 1.6.18
security Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter in 1.6.18
security Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions in 1.6.18
security Security: Fix RCE via cmd_learn driver of markasjunk plugin in 1.6.18
security Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization in 1.6.18
security Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host in 1.6.18
security Security: Fix stored XSS in "Add to address book" action in 1.6.18
security Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute in 1.6.18
security Fixes CVE-2026-62643: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styles… in 1.6.17
security Fixes CVE-2026-62644: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover. in 1.6.17
security Fixes CVE-2026-62641: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size. in 1.6.17
security Fixes CVE-2026-62642: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment. in 1.6.17
security Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost. in 1.6.17
security Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page CVE-2026-54432, reported by Bohdan Kurinnoy, Samsung R&D Instit in 1.6.17
security Fix SSRF bypass via specific local address URLs - two new cases, reported by Leenear. in 1.6.17
security Fix zero-click stored XSS in plain-text rendering CVE-2026-54433, reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR). in 1.6.17
security Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) in 1.6.17
security Security: Fix various vulnerabilities in the password plugin using session-injected username in 1.6.17
security Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page CVE-2026-54432 in 1.6.17
security Security: Fix SSRF bypass via specific local address URLs - two new cases in 1.6.17
security Security: Fix zero-click stored XSS in plain-text rendering CVE-2026-54433 in 1.6.17
security Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file in 1.6.17
security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.6.16
security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.6.16
security Fix SSRF bypass via specific local address URLs in 1.6.16
security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.6.16
security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.6.16
security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.6.16
security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.6.16
security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.6.16
security Security: Fix SSRF bypass via specific local address URLs in 1.6.16
security Security: Fix bypass of remote image blocking via CSS var() in 1.6.16
security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.6.16
security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.6.16
security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.6.16
security Fixes CVE-2026-35545: An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosur… in 1.6.15
security Fixes CVE-2026-35539: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment. in 1.6.14
security Fixes CVE-2026-35540: An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if… in 1.6.14
security Fixes CVE-2026-35542: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. T… in 1.6.14
security Fixes CVE-2026-35543: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lea… in 1.6.14
security Fixes CVE-2026-35541: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowin… in 1.6.14
security Fixes CVE-2026-35537: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated at… in 1.6.14
security Fixes CVE-2026-35538: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search. in 1.6.14
security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.6.14
security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.6.14
security Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. in 1.6.14
security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.6.14
security Security: Fix bug where a password could get changed without providing the old password in 1.6.14
security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.6.14
security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.6.14
security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.6.14
security Security: Fix fixed position mitigation bypass via use of !important in 1.6.14
security Security: Fix XSS issue in a HTML attachment preview in 1.6.14
security Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts in 1.6.14
security Fix CSS injection vulnerability reported by CERT Polska. in 1.6.13
security Fixes CVE-2025-68461: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. in 1.6.12
security Fixes CVE-2025-68460: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. in 1.6.12
security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
security Fixes CVE-2025-49113: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.… in 1.6.11
security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11
security Fix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009 in 1.6.8
security Fix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008 in 1.6.8
security Fix information leak (access to remote content) via insufficient CSS filtering CVE-2024-42010 in 1.6.8
security Fixes CVE-2024-37383: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. in 1.6.7
security Fixes CVE-2024-37385: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020… in 1.6.7
security Fixes CVE-2024-37384: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. in 1.6.7
security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. in 1.6.7
security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. in 1.6.7
security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes in 1.6.7
security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences in 1.6.7
security Update to TinyMCE 5.10.9 security release (#9228) in 1.6.6
security Fixes CVE-2023-47272: Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). in 1.6.5
security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec). in 1.6.5
security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download in 1.6.5
security Fixes CVE-2023-5631: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behav… in 1.6.4
security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko. in 1.6.4
security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.6.4
security Fixes CVE-2023-43770: Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. in 1.6.3
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.6.3
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.6.3
security Fixes CVE-2026-35545: An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosur… in 1.5.15
security Fixes CVE-2026-35539: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment. in 1.5.14
security Fixes CVE-2026-35542: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. T… in 1.5.14
security Fixes CVE-2026-35543: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lea… in 1.5.14
security Fixes CVE-2026-35541: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowin… in 1.5.14
security Fixes CVE-2026-35537: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated at… in 1.5.14
security Fixes CVE-2026-35538: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search. in 1.5.14
security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.5.14
security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.5.14
security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.5.14
security Security: Fix bug where a password could get changed without providing the old password in 1.5.14
security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.5.14
security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.5.14
security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.5.14
security Security: Fix fixed position mitigation bypass via use of !important in 1.5.14
security Security: Fix XSS issue in a HTML attachment preview in 1.5.14
security Fix CSS injection vulnerability reported by CERT Polska. in 1.5.13
security Fixes CVE-2025-68461: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. in 1.5.12
security Fixes CVE-2025-68460: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. in 1.5.12
security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.5.12
security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.5.12
security Fixes CVE-2025-49113: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.… in 1.5.10
security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.5.10
security Fix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009 in 1.5.8
security Fix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008 in 1.5.8
security Fix information leak (access to remote content) via insufficient CSS filtering CVE-2024-42010 in 1.5.8
security Fixes CVE-2024-37383: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. in 1.5.7
security Fixes CVE-2024-37385: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020… in 1.5.7
security Fixes CVE-2024-37384: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. in 1.5.7
security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. in 1.5.7
security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. in 1.5.7
security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes in 1.5.7
security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences in 1.5.7
security Fixes CVE-2023-47272: Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download). in 1.5.6
security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec). in 1.5.6
security Fixes CVE-2023-5631: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behav… in 1.5.5
security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.5.5
security Fixes CVE-2023-43770: Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. in 1.5.4
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.5.4
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.5.4
security Cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.5.2
security Security: fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.5.2
security Fix bug where attachment download could sometimes fail with a CSRF check error (#8283) in 1.5.1
security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193) in 1.5.0
security Fix SQL injection via some session variables in 1.5.0
security Fix security issues regarding server name and trusted_host_patterns setting in 1.5.0
security Fixes CVE-2023-5631: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behav… in 1.4.15
security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko. in 1.4.15
security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.4.15
security Fixes CVE-2023-43770: Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior. in 1.4.14
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.4.14
security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.4.14
security Cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.13
security Security: fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.13
security Fixes CVE-2021-44026: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. in 1.4.12
security Fixes CVE-2021-44025: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message. in 1.4.12
security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning in 1.4.12
security Fix possible SQL injection via some session variables in 1.4.12
security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193) in 1.4.12
security Fix SQL injection via some session variables in 1.4.12
security Fixes CVE-2021-26925: Roundcube before 1.4.11 allows XSS via crafted Cascading Style Sheets (CSS) token sequences during HTML email rendering. in 1.4.11
security Fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.11
security Security: Fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.11
security Stored cross-site scripting (XSS) via HTML or plain text messages with malicious content [CVE-2020-35730] in 1.4.10
security Security: Fix cross-site scripting (XSS) via HTML or plain text messages with malicious content in 1.4.10
security Fix potential XSS issue in HTML editor of the identity signature input in 1.4.8
security Fix cross-site scripting (XSS) via HTML messages with malicious svg content CVE-2020-16145 in 1.4.8
security Fix cross-site scripting (XSS) via HTML messages with malicious math content in 1.4.8
security Security: Fix potential XSS issue in HTML editor of the identity signature input (#7507) in 1.4.8
security Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145] in 1.4.8
security Security: Fix cross-site scripting (XSS) via HTML messages with malicious math content in 1.4.8
security Prevent cross-site scripting (XSS) via HTML messages with malicious svg/namespace (CVE-2020-15562) in 1.4.7
security Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace in 1.4.7
security Fixes CVE-2020-13965: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview. in 1.4.5
security Fixes CVE-2020-13964: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object. in 1.4.5
security Fix XSS issue in template object 'username' (#7406) in 1.4.5
security Fix cross-site scripting (XSS) via malicious XML attachment in 1.4.5
security Fix a couple of XSS issues in Installer (#7406) in 1.4.5
security Better fix for CVE-2020-12641 in 1.4.5
security Security: Fix a couple of XSS issues in Installer (#7406) in 1.4.5
security Security: Fix XSS issue in template object 'username' (#7406) in 1.4.5
security Security: Fix cross-site scripting (XSS) via malicious XML attachment in 1.4.5
security Security: Better fix for CVE-2020-12641 in 1.4.5
security Fixes CVE-2020-12641: rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. in 1.4.4
security Fixes CVE-2020-12640: Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. in 1.4.4
security Fixes CVE-2020-12626: An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered. in 1.4.4
security Fixes CVE-2020-12625: An issue was discovered in Roundcube Webmail before 1.4.4. There is a cross-site scripting (XSS) vulnerability in rcube_washtml.php because JavaScript code can occur in the CDATA of an HTML message. in 1.4.4
security Cross-Site Scripting (XSS) via malicious HTML content in 1.4.4
security CSRF attack can cause an authenticated user to be logged out in 1.4.4
security Remote code execution via crafted config options in 1.4.4
security Path traversal vulnerability allowing local file inclusion via crafted 'plugins' option in 1.4.4
security Security: Fix XSS issue in handling of CDATA in HTML messages in 1.4.4
security Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings in 1.4.4
security Security: Fix local file inclusion (and code execution) via crafted 'plugins' option in 1.4.4
security Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302) in 1.4.4
security Fixes CVE-2021-44026: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. in 1.3.17
security Fixes CVE-2021-44025: Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to XSS in handling an attachment's filename extension when displaying a MIME type warning message. in 1.3.17
security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning in 1.3.17
security Fix possible SQL injection via some session variables in 1.3.17
security This is a security update to the LTS version 1.3. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content [CVE-2020-35730]. in 1.3.16
security Fixes CVE-2020-16145: Roundcube Webmail before 1.3.15 and 1.4.8 allows stored XSS in HTML messages during message display via a crafted SVG document. This issue has been fixed in 1.4.8 and 1.3.15. in 1.3.15
security This is a security update to the LTS version 1.3. It fixes two recently reported cross-site scripting (XSS) vulnerabilities via HTML messages with malicious svg and math contents. in 1.3.15
security This is a security update to the LTS version 1.3. It fixes a recently reported cross-site scripting (XSS) vulnerability via HTML messages with malicious svg/namespace (CVE-2020-15562). in 1.3.14
security Fixes CVE-2020-13965: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. There is XSS via a malicious XML attachment because text/xml is among the allowed types for a preview. in 1.3.12
security Fixes CVE-2020-13964: An issue was discovered in Roundcube Webmail before 1.3.12 and 1.4.x before 1.4.5. include/rcmail_output_html.php allows XSS via the username template object. in 1.3.12
security Fix XSS issue in template object 'username' (#7406) in 1.3.12
security Fix cross-site scripting (XSS) via malicious XML attachment in 1.3.12
security Fix a couple of XSS issues in Installer (#7406) in 1.3.12
security Better fix for CVE-2020-12641 in 1.3.12
security Security: Better fix for CVE-2020-12641 in 1.3.12
security Security: Fix XSS issue in template object 'username' (#7406) in 1.3.12
security Security: Fix couple of XSS issues in Installer (#7406) in 1.3.12
security Security: Fix cross-site scripting (XSS) via malicious XML attachment in 1.3.12
security Fixes CVE-2020-12641: rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. in 1.3.11
security Fixes CVE-2020-12640: Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. in 1.3.11
security Cross-Site Scripting (XSS) via malicious HTML content in 1.3.11
security CSRF attack can cause an authenticated user to be logged out in 1.3.11
security Remote code execution via crafted config options in 1.3.11
security Path traversal vulnerability allowing local file inclusion via crafted 'plugins' option in 1.3.11
security Security: Fix XSS issue in handling of CDATA in HTML messages in 1.3.11
security Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings in 1.3.11
security Security: Fix local file inclusion (and code execution) via crafted 'plugins' option in 1.3.11
security Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302) in 1.3.11
security Enigma: Fix "decryption oracle" bug CVE-2019-10740 (#6638) in 1.3.10
security Fix missing CSRF token on a link to download too-big message part (#6621) in 1.3.9
security Fixes CVE-2018-19206: steps/mail/func.inc in Roundcube before 1.3.8 has XSS via crafted use of <svg><style>, as demonstrated by an onload attribute in a BODY element, within an HTML attachment. in 1.3.8
security Fix XSS issue in handling invalid style tag content (#6410) in 1.3.8
security Fixes CVE-2018-19205: Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated… in 1.3.7
security Fix bug where some escape sequences in html styles could bypass security checks in 1.3.7
security This is a security update to the stable version 1.3. It primarily fixes a recently discovered IMAP command injection vulnerability caused by insufficient input validation within the archive plugin. Details about the vulnerability are published under CVE-2018-9846. in 1.3.6
security Fix possible IMAP command injection and type juggling vulnerabilities (#6229) in 1.3.6
security Fix check_request() bypass in places using get_uids() CVE-2018-9846 (#6238) in 1.3.6
security Fix security issue in remote content blocking on HTML image and style tags (#6178) in 1.3.5
security This is a security update to the stable version 1.3. It primarily fixes a recently discovered file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. More details will be published under CVE-2017-16651. in 1.3.3
security Fix file disclosure vulnerability caused by insufficient input validation (#6026) in 1.3.3
security Fix potential XSS vulnerability with malformed HTML message markup in 1.3.1
security Improve randomness of password salts and random hashes in 1.3.0
security Fixed redundancy in sql caching system and compatibility with Galera Cluster in 1.3.0
security Fix XSS issue in handling of a style tag inside of an svg element [CVE-2017-6820] in 1.3.0
security Password: Fix security issue in virtualmin and sasl drivers [CVE-2017-8114] in 1.3.0
security This is a security update to the LTS version 1.2. It fixes a recently reported stored cross-site scripting (XSS) vulnerability via HTML or plain text messages with malicious content [CVE-2020-35730]. in 1.2.13
security This is a security update to the LTS version 1.2. It fixes two recently reported cross-site scripting (XSS) vulnerabilities via HTML messages with malicious svg and math contents. in 1.2.12
security This is a security update to the LTS version 1.2. It fixes a recently reported cross-site scripting (XSS) vulnerability via HTML messages with malicious svg/namespace (CVE-2020-15562). in 1.2.11
security Fixes CVE-2020-12641: rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. in 1.2.10
security Fixes CVE-2020-12640: Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. in 1.2.10
security Cross-Site Scripting (XSS) via malicious HTML content in 1.2.10
security CSRF attack can cause an authenticated user to be logged out in 1.2.10
security Remote code execution via crafted config options in 1.2.10
security Path traversal vulnerability allowing local file inclusion via crafted 'plugins' option in 1.2.10
security Security: Fix XSS issue in handling of CDATA in HTML messages in 1.2.10
security Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings in 1.2.10
security Security: Fix local file inclusion (and code execution) via crafted 'plugins' option in 1.2.10
security Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302) in 1.2.10
security This is a security update to the stable version 1.2. It fixes a recently reported vulnerability allowing IMAP command injection via a GET parameters. More details about this are published under CVE-2018-9846. in 1.2.8
security Fix check_request() bypass in places using get_uids() CVE-2018-9846 (#6238) in 1.2.8
security Fix possible IMAP command injection vulnerability CVE-2018-9846 (#6229) in 1.2.8
security Fix security issue in remote content blocking on HTML image and style tags (#6178) in 1.2.8
security This is a security update to the stable version 1.2. It primarily fixes a recently discovered file disclosure vulnerability caused by insufficient input validation in conjunction with file-based attachment plugins, which are used by default. More details will be published under CVE-2017-16651. in 1.2.7
security Fix file disclosure vulnerability caused by insufficient input validation (#6026) in 1.2.7

Deprecations

deprecated Fix PHP8 deprecation warning in the reconnect plugin (#9083) in 1.6.3
deprecated Fix deprecated use of ldap_connect() in password's ldap_simple driver (#9060) in 1.6.3
deprecated Fix PHP 7.4 deprecation: implode() wrong parameter order (#6866) in 1.3.10
deprecated Fix PHP warning "idn_to_utf8(): INTL_IDNA_VARIANT_2003 is deprecated" with PHP 7.2 (#6075) in 1.3.4

Every release in between

1.6.19 Sep 6, 2026 Release notes ↗

fixFix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai

fixFix CSS property injection via body background attribute, reported by zenithhostingevan

fixFix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo

fixFix email header injection via C-escape \r in the recipient display name, reported by dogeshark

fixFix email header injection via identity's organization field, reported by dogeshark

securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko

securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers

fixFix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers

fixFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337

fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by neoxed

fixFix remote-content blocker bypass via SVG SMIL src animation

securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy

fixFix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)

securitySecurity: Fix CSS declaration smuggling via un-encoded ampersand emission

securitySecurity: Fix CSS property injection via body background attribute

securitySecurity: Fix email header injection via bare CR in the subject field

securitySecurity: Fix email header injection via C-escape \r in the recipient display name

securitySecurity: Fix email header injection via identity's organization field

securitySecurity: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL

securitySecurity: Fix XSS in the HTML editor using text/enriched part content

securitySecurity: Fix cross-user access in contact group membership (add/remove) in the SQL address book

securitySecurity: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL

securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes

securitySecurity: Fix remote-content blocker bypass via SVG SMIL src animation

securitySecurity: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

1.6.18 Aug 9, 2026 Release notes ↗

securityFixes CVE-2026-74997: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject to remote code execution via crafted placeholder replacement values. This issue o…

securityFixes CVE-2026-74998: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were not validated, which may result in information disclosure or XSS (cross-site sc…

securityFixes CVE-2026-75002: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command inject…

securityFixes CVE-2026-75010: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Modoboa API authentication token to a user-controlled host via crafted session data…

securityFixes CVE-2026-75006: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styles…

securityFixes CVE-2026-75000: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" attribute may lead to remote image blocking bypass, which in turn may lead to infor…

securityFixes CVE-2026-75003: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image could evade the remote image blocking, which may lead to information disclosure o…

securityFixes CVE-2026-75007: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unescaped %u/%fu/%d substitution, which may lead to information disclosure or privileg…

securityFixes CVE-2026-74999: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS.

securityFixes CVE-2026-75004: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disabled_actions setting bypass via a crafted rule name in a Sieve script. This issue…

featureAdd basic validation for content proxied by the css proxy

securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko

securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe

fixFix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe

fixFix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter, reported by Milan Hoppe

fixFix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions, reported by Milan Hoppe

securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337

fixFix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai

fixFix password's modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun

securityFix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai

fixFix HTML/CSS sanitization bypass via SVG animate by attribute, reported by vectrain

fixPassword: Fix fatal error "Class 'Zxcvbn' not found" (#10274)

fixFix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)

securitySecurity: Add basic validation for content proxied by the css proxy

securitySecurity: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets

securitySecurity: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check

securitySecurity: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute

securitySecurity: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter

securitySecurity: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions

securitySecurity: Fix RCE via cmd_learn driver of markasjunk plugin

securitySecurity: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization

securitySecurity: Fix password's modoboa driver leak of an authentication token to a user-controlled host

securitySecurity: Fix stored XSS in "Add to address book" action

securitySecurity: Fix HTML/CSS sanitization bypass via SVG animate by attribute

1.6.17 Jul 5, 2026 Release notes ↗

securityFixes CVE-2026-62643: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if styles…

securityFixes CVE-2026-62644: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject to username spoofing via session data, which could lead to account takeover.

securityFixes CVE-2026-62641: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a crafted compressed-RTF size.

securityFixes CVE-2026-62642: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which may lead to denial of service upon opening an email with a TNEF attachment.

fixFix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.

securityFix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.

securityFix stored XSS via unescaped attachment MIME type on the attachment-validation warning page CVE-2026-54432, reported by Bohdan Kurinnoy, Samsung R&D Instit

securityFix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.

securityFix zero-click stored XSS in plain-text rendering CVE-2026-54433, reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR).

fixFix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file, reported by h0rk1p.

otherEnigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)

otherEnigma: Kolab WOAT Support (#8626)

securitySecurity: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)

securitySecurity: Fix various vulnerabilities in the password plugin using session-injected username

securitySecurity: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page CVE-2026-54432

securitySecurity: Fix SSRF bypass via specific local address URLs - two new cases

securitySecurity: Fix zero-click stored XSS in plain-text rendering CVE-2026-54433

securitySecurity: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file

1.6.16 May 24, 2026 Release notes ↗

securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)

fixFix CSS injection bypass in HTML sanitizer via SVG , reported by wooseokdotkim

securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull

securityFix SSRF bypass via specific local address URLs

securityFix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team

fixFix bypass of remote image blocking via CSS var(), reported by Geame

fixFix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1

securityFix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri

fixFix potential too long value in IMAP ID command (#10136)

securitySecurity: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog

securitySecurity: Fix CSS injection bypass in HTML sanitizer via SVG

securitySecurity: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass

securitySecurity: Fix SSRF bypass via specific local address URLs

securitySecurity: Fix bypass of remote image blocking via CSS var()

securitySecurity: Fix local/private URL fetch bypass when remote resources were not allowed

securitySecurity: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass

securitySecurity: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option

1.6.15 Mar 29, 2026 Release notes ↗

securityFixes CVE-2026-35545: An issue was discovered in Roundcube Webmail before 1.5.15 and 1.6.15. The remote image blocking feature can be bypassed via SVG content in an e-mail message. This may lead to information disclosur…

otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

fixFix regression where mail search would fail on non-ascii search criteria (#10121)

fixFix regression where some data url images could get ignored/lost (#10128)

fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

1.6.14 Mar 18, 2026 Release notes ↗

securityFixes CVE-2026-35539: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment.

securityFixes CVE-2026-35540: An issue was discovered in Roundcube Webmail 1.6.0 before 1.6.14. Insufficient Cascading Style Sheets (CSS) sanitization in HTML e-mail messages may lead to SSRF or Information Disclosure, e.g., if…

securityFixes CVE-2026-35542: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via a crafted background attribute of a BODY element in an e-mail message. T…

securityFixes CVE-2026-35543: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. The remote image blocking feature can be bypassed via SVG content (with animate attributes) in an e-mail message. This may lea…

securityFixes CVE-2026-35541: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Incorrect password comparison in the password plugin could lead to type confusion that allows a password change without knowin…

securityFixes CVE-2026-35537: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsafe deserialization in the redis/memcache session handler may lead to arbitrary file write operations by unauthenticated at…

securityFixes CVE-2026-35538: An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. Unsanitized IMAP SEARCH command arguments could lead to IMAP injection or CSRF bypass during mail search.

fixFix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.

fixFix bug where a password could get changed without providing the old password, reported by flydragon777.

securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.

fixFix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.

fixFix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.

fixFix fixed position mitigation bypass via use of !important, reported by nullcathedral.

securityFix XSS issue in a HTML attachment preview, reported by aikido_security.

securityFix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.

fixFix Postgres connection using IPv6 address (#10104)

securitySecurity: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler

securitySecurity: Fix bug where a password could get changed without providing the old password

securitySecurity: Fix IMAP Injection + CSRF bypass in mail search

securitySecurity: Fix remote image blocking bypass via various SVG animate attributes

securitySecurity: Fix remote image blocking bypass via a crafted body background attribute

securitySecurity: Fix fixed position mitigation bypass via use of !important

securitySecurity: Fix XSS issue in a HTML attachment preview

securitySecurity: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts

1.6.13 Feb 8, 2026 Release notes ↗

securityFix CSS injection vulnerability reported by CERT Polska.

fixFix remote image blocking bypass via SVG content reported by nullcathedral.

fixManagesieve: Fix handling of string-list format values for date tests in Out of Office (#10075)

1.6.12 Dec 14, 2025 Release notes ↗

securityFixes CVE-2025-68461: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document.

securityFixes CVE-2025-68460: Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer.

securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.

securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.

otherSupport IPv6 in database DSN (#9937)

otherDon't force specific error_reporting setting

fixFix compatibility with PHP 8.5 regarding array_first()

securityRemove X-XSS-Protection example from .htaccess file (#9875)

fixFix "Assign to group" action state after creation of a first group (#9889)

fixFix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)

fixFix bug where an mbox export file could include inconsistent message delimiters (#9879)

fixFix parsing of inline styles that aren't well-formatted (#9948)

securityFix Cross-Site-Scripting vulnerability via SVG's animate tag

securityFix Information Disclosure vulnerability in the HTML style sanitizer

1.6.11 Jun 1, 2025 Release notes ↗

securityFixes CVE-2025-49113: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.…

securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.

fixManagesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)

otherImprove installer to fix confusion about disabling SMTP authentication (#9801)

fixFix PHP warning in index.php (#9813)

fixOAuth: Fix/improve token refresh

fixFix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)

fixFix HTML message preview if it contains floating tables (#9804)

fixFix removing/expiring redis/memcache records when using a key prefix

fixFix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)

fixFix a default value and documentation of password_ldap_encodage option (#9658)

breakingRemove mobile/floating Create button from the list in Settings > Folders (#9661)

fixFix Delete and Empty buttons state while creating a folder (#9047)

fixFix connecting to LDAP using ldapi:// URI (#8990)

fixFix cursor position on "below the quote" reply in HTML mode (#8700)

fixFix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)

1.6.10 Feb 8, 2025 Release notes ↗

featureIMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)

otherOAuth: Support standard authentication with short-living password received with OIDC token (#9530)

fixFix PHP warnings (#9616, #9611)

fixFix whitespace handling in vCard line continuation (#9637)

fixFix current script state after initial scripts creation in managesieve_kolab_master mode

fixFix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)

fixFix regression causing inline SVG images to be missing in mail preview (#9644)

fixFix plugin "virtuser_file" to handle backward slashes in username (#9668)

fixFix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)

fixFix insert_or_update() and reading database server config on PostgreSQL (#9710)

fixFix Oauth issues with use_secure_urls=true (#9722)

fixFix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)

fixFix links in comments and config to https:// where available (#9759, #9756)

fixFix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)

1.6.9 Sep 1, 2024 Release notes ↗

fixFix regression where printing/scaling/rotating image attachments was broken (#9571)

fixFix regression where HTML messages were displayed unstyled (#9586)

1.6.8 Aug 4, 2024 Release notes ↗

securityFix XSS vulnerability in post-processing of sanitized HTML content CVE-2024-42009

securityFix XSS vulnerability in serving of attachments other than HTML or SVG CVE-2024-42008

securityFix information leak (access to remote content) via insufficient CSS filtering CVE-2024-42010

otherManagesieve: Protect special scripts in managesieve_kolab_master mode

fixFix newmail_notifier notification focus in Chrome (#9467)

fixFix fatal error when parsing some TNEF attachments (#9462)

fixFix double scrollbar when composing a mail with many plain text lines (#7760)

fixFix decoding mail parts with multiple base64-encoded text blocks (#9290)

fixFix bug where some messages could get malformed in an import from a MBOX file (#9510)

fixFix invalid line break characters in multi-line text in Sieve scripts (#9543)

fixFix bug where "with attachment" filter could fail on some fts engines (#9514)

fixFix bug where an unhandled exception was caused by an invalid image attachment (#9475)

fixFix bug where a long subject title could not be displayed in some cases (#9416)

fixFix infinite loop when parsing malformed Sieve script (#9562)

fixFix bug where imap_conn_option's 'socket' was ignored (#9566)

1.6.7 May 19, 2024 Release notes ↗

securityFixes CVE-2024-37383: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes.

securityFixes CVE-2024-37385: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020…

securityFixes CVE-2024-37384: Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences.

securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike.

securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật.

fixFix command injection via crafted im_convert_path/im_identify_path on Windows. Reported by Huy Nguyễn Phạm Nhật.

otherMakefile: Use phpDocumentor v3.4 for the Framework docs (#9313)

fixFix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)

fixFix bug in collapsing/expanding folders with some special characters in names (#9324)

fixFix PHP8 warnings (#9363, #9365, #9429)

fixFix missing field labels in CSV import, for some locales (#9393)

securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes

securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences

fixFix command injection via crafted im_convert_path/im_identify_path on Windows

1.6.6 Jan 20, 2024 Release notes ↗

fixFix regression in handling LDAP search_fields configuration parameter (#9210)

fixEnigma: Fix finding of a private key when decrypting a message using GnuPG v2.3

fixFix page jump menu flickering on click (#9196)

securityUpdate to TinyMCE 5.10.9 security release (#9228)

fixFix PHP8 warnings (#9235, #9238, #9242, #9306)

fixFix saving other encryption settings besides enigma's (#9240)

fixFix unneeded php command use in installto.sh and deluser.sh scripts (#9237)

fixFix TinyMCE localization installation (#9266)

breakingFix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257)

fixFix IMAP GETMETADATA command with options - RFC5464

1.6.5 Nov 5, 2023 Release notes ↗

securityFixes CVE-2023-47272: Roundcube 1.5.x before 1.5.6 and 1.6.x before 1.6.5 allows XSS via a Content-Type or Content-Disposition header (used for attachment preview or download).

securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec).

fixFix PHP8 fatal error when parsing a malformed BODYSTRUCTURE (#9171)

fixFix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters (#9166)

fixFix PHP warnings (#9174)

fixFix UI issue when dealing with an invalid managesieve_default_headers value (#9175)

fixFix bug where images attached to application/smil messages weren't displayed (#8870)

fixFix PHP string replacement error in utils/error.php (#9185)

fixFix regression where smtp_user did not allow pre/post strings before/after %u placeholder (#9162)

securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download

1.6.4 Oct 16, 2023 Release notes ↗

securityFixes CVE-2023-5631: Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behav…

securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko.

fixFix PHP8 warnings (#9142, #9160)

fixFix default 'mime.types' path on Windows (#9113)

fixManagesieve: Fix javascript error when relational or spamtest extension is not enabled (#9139)

securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)

1.6.3 Sep 15, 2023 Release notes ↗

securityFixes CVE-2023-43770: Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of program/lib/Roundcube/rcube_string_replacer.php behavior.

securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar.

fixFix bug where installto.sh/update.sh scripts were removing some essential options from the config file (#9051)

otherUpdate jQuery-UI to version 1.13.2 (#9041)

fixFix regression that broke use_secure_urls feature (#9052)

fixFix potential PHP fatal error when opening a message with message/rfc822 part (#8953)

fixFix bug where a duplicate tag in HTML email could cause some parts being cut off (#9029)

fixFix bug where a list of folders could have been sorted incorrectly (#9057)

fixFix regression where LDAP addressbook 'filter' option was ignored (#9061)

fixFix wrong order of a multi-folder search result when sorting by size (#9065)

fixFix so install/update scripts do not require PEAR (#9037)

fixFix regression where some mail parts could have been decoded incorrectly, or not at all (#9096)

fixFix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to non-binary FETCH (#9097)

deprecatedFix PHP8 deprecation warning in the reconnect plugin (#9083)

fixFix "Show source" on mobile with x_frame_options = deny (#9084)

fixFix various PHP warnings (#9098)

deprecatedFix deprecated use of ldap_connect() in password's ldap_simple driver (#9060)

securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages

1.6.2 Jul 2, 2023 Release notes ↗

featureAdd Uyghur localization

fixFix regression in OAuth request URI caused by use of REQUEST_URI instead of SCRIPT_NAME as a default (#8878)

fixFix bug where false attachment reminder was displayed on HTML mail with inline images (#8885)

fixFix bug where a non-ASCII character in app.js could cause error in javascript engine (#8894)

fixFix JWT decoding with url safe base64 schema (#8890)

fixFix bug where .wav instead of .mp3 file was used for the new mail notification in Firefox (#8895)

fixFix PHP8 warning (#8891)

fixFix support for Windows-31J charset (#8869)

fixFix so LDAP VLV option is disabled by default as documented (#8833)

fixFix so an email address with name is supported as input to the managesieve notify :from parameter (#8918)

fixFix Help plugin menu (#8898)

fixFix invalid onclick handler on the logo image when using non-array skin_logo setting (#8933)

fixFix duplicate recipients in "To" and "Cc" on reply (#8912)

fixFix bug where it wasn't possible to scroll lists by clicking middle mouse button (#8942)

fixFix bug where label text in a single-input dialog could be partially invisible in some locales (#8905)

fixFix bug where LDAP (fulltext) search didn't work without 'search_fields' in config (#8874)

fixFix extra leading newlines in plain text converted from HTML (#8973)

fixFix so recipients with a domain ending with .s are allowed (#8854)

fixFix so vCard output does not contain non-standard/redundant TYPE=OTHER and TYPE=INTERNET (#8838)

fixFix QR code images for contacts with non-ASCII characters (#9001)

fixFix PHP8 warnings when using list_flags and list_cols properties by plugins (#8998)

fixFix bug where subfolders could loose subscription on parent folder rename (#8892)

fixFix connecting to LDAP using an URI with ldapi:// scheme (#8990)

fixFix insecure shell command params handling in cmd_learn driver of markasjunk plugin (#9005)

fixFix bug where some mail headers didn't work in cmd_learn driver of markasjunk plugin (#9005)

fixFix PHP fatal error when importing vcf file using PHP 8.2 (#9025)

fixFix so output of log_date_format with microseconds contains time in server time zone, not UTC

1.6.1 Jan 23, 2023 Release notes ↗

otherKill session if refreshing oauth token fails (#8734)

fixFix various PHP 8.1 warnings (#8628, #8644, #8667, #8656, #8647)

breakingPassword: Remove references to %c variable that has been removed before (#8633)

fixFix anchor links in HTML mail (#8632)

fixFix bug where config creation in Installer did ignore options in the form (#8634)

breakingFix bug where renamed options were removed from the config on installto.sh (update.sh) run (#8643)

fixFix favicon rewrite rule in .htaccess (#8654)

fixFix various PHP 8.2 warnings

fixFix bug where it wasn't possible to create more than one response record on SQLite and Postgres (#8664)

fixFix support for ManageSieve over implicit SSL (#8670)

fixFix bug where "about:blank" page could trigger "load error" (#8554)

fixFix bug where setting 'Clear Trash on Logout' to 'all messages' didn't work (#8687)

fixFix bug where the attachment menu wouldn't disappear after an action is selected (#8691)

fixFix bug where some dialogs in an eml attachment preview would not close on mobile (#8627)

fixFix bug where multiline data:image URI's in emails were stripped from the message on display (#8613)

fixFix fatal error on identity page if Enigma plugin is misconfigured (#8719)

fixFix so N property always exists in a vCard export (#8771)

fixFix authenticating to Courier IMAP with passwords containing a '~' character (#8772)

fixFix handling of smtp/imap port options on configuration file update (#8756)

fixFix bug where array values could not be saved in utils/save_pref action (#8781)

featureAdd workaround for using Roundcube behind a reverse proxy with a subpath: 'request_path' option (#8738, #8770)

fixFix bug where "Invalid skin name" error was logged on preferences save if there's only one skin (#8825)

fixFix SIGBUS raised in ImageMagick when more than one process tried to generate a thumbnail of the same image attachment (#8511)

fixFix bug where updater does not update the vendor packages (#8642)

fixFix missing mail composing textarea on reply/draft with a long plain text content (#8866)

1.6.0 Jul 28, 2022 Release notes ↗

otherPHP 8.1 support

breakingDropped support for PHP < 7.3

otherSupport responses (snippets) in HTML format

otherOption to purge deleted mails older than 30, 60 or 90 days

otherUnified and simplified services connection config options

breakingRemoved the Classic and Larry skins from the release packages

otherSQLite: Use foreign keys, require SQLite >= 3.6.19

breakingIMAP:

breakingrenamed default_host to imap_host

breakingremoved default_port option (non-standard port can be set via imap_host)

breakingset "localhost:143" as a default for imap_host

breakingSMTP:

breakingrenamed smtp_server to smtp_host

breakingremoved smtp_port option (non-standard port can be set via smtp_host)

breakingset "localhost:587" as a default for smtp_host

breakingLDAP:

breakingremoved port option from ldap_public array (non-standard port can be set via host)

breakingremoved use_tls option from ldap_public array (use tls:// prefix in host)

breakingManagesieve:

breakingremoved managesieve_port option (non-standard port can be set via managesieve_host)

breakingremoved managesieve_usetls option (set tls:// prefix to managesieve_host)

fixFix SMTP XCLIENT extension when not using STARTTLS (#8581)

fixFix call to undefined method rcube_ldap_generic::option_set() (#8564)

breakingFix PHP Fatal error on incompatible method declaration of rcmail_output_json::command() and rcmail_output::command() (#8579)

fixFix support for DSN specification without host e.g. pgsql:///dbname (#8558)

fixFix TinyMCE configuration for handling styles of pasted content in webkit browsers (#8555)

fixFix bug where some checkboxes could be selected unintentinally (#8565)

fixFix css styles of the email recipient element while dragging (#8580)

fixFix PHP 8.1 warnings in the LDAP backend code (#8572)

fixFix various PHP 8.1 warnings (#8584)

fixFix bug where a recipient address containing UTF-8 characters was ignored when sending an email (#8493, #8546)

fixFix so rcmail::contact_exists() works with IDNA addresses (#8545)

fixFix password option in storage_init hook after refreshing oauth access token (#8436)

fixFix attachment Options popover menu after attachment delete (#8602)

fixFix so "Found unconstructed Spoofchecker" error is not fatal (#8537)

1.5.15 Mar 29, 2026 Release notes ↗

otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.

fixFix so distribution packages (and composer.json) don't include development dependencies

fixFix regression where mail search would fail on non-ascii search criteria (#10121)

fixFix regression where some data url images could get ignored/lost (#10128)

fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke

1.5.14 Mar 18, 2026 Release notes ↗