VersionDrift
Product

Roundcube 1.3.17 → 1.7.5

59 releases · 33 breaking changes · 252 security fixes · 0 advisories fixed

252security33breaking4deprecated18feature486fix

Is 1.3.17 affected?

Breaking changes

  • breaking Dropped support for PHP < 8.1. in 1.7.0
  • breaking Dropped support for Internet Explorer. in 1.7.0
  • breaking Dropped support for MS SQL Server and Oracle. in 1.7.0
  • breaking public_html/ entry-point made mandatory, all static resources are served via public_html/static.php. in 1.7.0
  • breaking Removed apc cache driver (replaced by apcu cache driver). in 1.7.0
  • breaking Changed smtp_log option default value to false. in 1.7.0
  • breaking Removed contact_search_name option in favor of contactlist_name_template. in 1.7.0
  • breaking Replaced session property changed by expires_at. in 1.7.0
  • breaking Removed the (insecure) virtualmin password driver. in 1.7.0
  • breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11
  • breaking Fix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257) in 1.6.6
  • breaking Password: Remove references to %c variable that has been removed before (#8633) in 1.6.1
  • breaking Fix bug where renamed options were removed from the config on installto.sh (update.sh) run (#8643) in 1.6.1
  • breaking Dropped support for PHP < 7.3 in 1.6.0
  • breaking Removed the Classic and Larry skins from the release packages in 1.6.0
  • breaking IMAP: in 1.6.0
  • breaking renamed default_host to imap_host in 1.6.0
  • breaking removed default_port option (non-standard port can be set via imap_host) in 1.6.0
  • breaking set "localhost:143" as a default for imap_host in 1.6.0
  • breaking SMTP: in 1.6.0
  • breaking renamed smtp_server to smtp_host in 1.6.0
  • breaking removed smtp_port option (non-standard port can be set via smtp_host) in 1.6.0
  • breaking set "localhost:587" as a default for smtp_host in 1.6.0
  • breaking LDAP: in 1.6.0
  • breaking removed port option from ldap_public array (non-standard port can be set via host) in 1.6.0
  • breaking removed use_tls option from ldap_public array (use tls:// prefix in host) in 1.6.0
  • breaking Managesieve: in 1.6.0
  • breaking removed managesieve_port option (non-standard port can be set via managesieve_host) in 1.6.0
  • breaking removed managesieve_usetls option (set tls:// prefix to managesieve_host) in 1.6.0
  • breaking Fix PHP Fatal error on incompatible method declaration of rcmail_output_json::command() and rcmail_output::command() (#8579) in 1.6.0
  • breaking ### new defaults for smtp_* config options: Upon many requests and in order to get closer to the default setup of most SMTP servers, we changed the defaults as follows: // SMTP port (default is 587) $config['smtp_port'] = 587; // SMTP username (if required). %u will use the current username for… in 1.4.1
  • breaking ### changed default password_charset to UTF-8: Because of many complaints, we decided to choose a more sane default that covers most setups and configurations. in 1.4.1
  • breaking ### login page returning 401 Unauthorized status: The new behavior that Roundcube 1.4 returns a 401 status code if the client is not authenticated apparently was very unexpected and lead to monitoring problems. Despite not having mentioned that change in the release notes, we now partly reverted… in 1.4.1

Security changes

  • security Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect. in 1.7.5
  • security Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5
  • security Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5
  • security Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action in 1.7.5
  • security Security: Fix bug where an alias login wasn't qualified by IMAP host in 1.7.5
  • security Security: Add a size limit to the CSS proxy content processing in 1.7.5
  • security Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 in 1.7.5
  • security Security: Fix remote content blocking bypass via SVG SMIL by attribute in 1.7.5
  • security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) in 1.7.5
  • security Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize in 1.7.5
  • security Security: Fix mail header injection via the From display-name in the Bounce (resend) action in 1.7.5
  • security Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters in 1.7.5
  • security Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys in 1.7.5
  • security Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation in 1.7.5
  • security Security: Fix CSS scoping bypass in HTML messages using at-rules in 1.7.5
  • security Security: Fix bug where deprecated action aliases bypassed disabled_actions setting in 1.7.5
  • security Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action in 1.7.5
  • security Security: Fix CSRF validation bypass in the mark-as-junk action in 1.7.5
  • security Security: Fix XSS issue in handling of password driver error responses in 1.7.5
  • security Security: Fix mail header injection via subject of a message forwarded as attachment in 1.7.5
  • security Security: Fix mail header injection via media type in an inline image data URI in 1.7.5
  • security Security: Fix bug where Password Modoboa driver could change password for another account in 1.7.5
  • security Security: Fix unsafe use of a login name in SquirrelMail import file path in 1.7.5
  • security Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko in 1.7.4
  • security Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers in 1.7.4
  • security Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy in 1.7.4
  • security Security: Fix CSS declaration smuggling via un-encoded ampersand emission in 1.7.4
  • security Security: Fix CSS property injection via body background attribute in 1.7.4
  • security Security: Fix email header injection via bare CR in the subject field in 1.7.4
  • security Security: Fix email header injection via C-escape \r in the recipient display name in 1.7.4
  • security Security: Fix email header injection via identity's organization field in 1.7.4
  • security Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL in 1.7.4
  • security Security: Fix XSS in the HTML editor using text/enriched part content in 1.7.4
  • security Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book in 1.7.4
  • security Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL in 1.7.4
  • security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes in 1.7.4
  • security Security: Fix remote-content blocker bypass via SVG SMIL src animation in 1.7.4
  • security Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses in 1.7.4
  • security Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko in 1.7.3
  • security Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe in 1.7.3
  • security Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 in 1.7.3
  • security Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai in 1.7.3
  • security Security: Add basic validation for content proxied by the css proxy in 1.7.3
  • security Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets in 1.7.3
  • security Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check in 1.7.3
  • security Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute in 1.7.3
  • security Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter in 1.7.3
  • security Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions in 1.7.3
  • security Security: Fix RCE via cmd_learn driver of markasjunk plugin in 1.7.3
  • security Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization in 1.7.3
  • security Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host in 1.7.3
  • security Security: Fix stored XSS in "Add to address book" action in 1.7.3
  • security Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute. in 1.7.3
  • security Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost. in 1.7.2
  • security Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit in 1.7.2
  • security Fix SSRF bypass via specific local address URLs - two new cases, reported by Leenear. in 1.7.2
  • security Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR). in 1.7.2
  • security Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) in 1.7.2
  • security Security: Fix various vulnerabilities in the password plugin using session-injected username in 1.7.2
  • security Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432] in 1.7.2
  • security Security: Fix SSRF bypass via specific local address URLs - two new cases in 1.7.2
  • security Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433] in 1.7.2
  • security Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file in 1.7.2
  • security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.7.1
  • security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.7.1
  • security Fix SSRF bypass via specific local address URLs in 1.7.1
  • security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.7.1
  • security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.7.1
  • security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.7.1
  • security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.7.1
  • security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.7.1
  • security Security: Fix SSRF bypass via specific local address URLs in 1.7.1
  • security Security: Fix bypass of remote image blocking via CSS var() in 1.7.1
  • security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.7.1
  • security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.7.1
  • security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.7.1
  • security Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect. in 1.6.20
  • security Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.6.20
  • security Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.6.20
  • security Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action in 1.6.20
  • security Security: Fix bug where an alias login wasn't qualified by IMAP host in 1.6.20
  • security Security: Add a size limit to the CSS proxy content processing in 1.6.20
  • security Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 in 1.6.20
  • security Security: Fix remote content blocking bypass via SVG SMIL by attribute in 1.6.20
  • security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) in 1.6.20
  • security Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize in 1.6.20
  • security Security: Fix mail header injection via the From display-name in the Bounce (resend) action in 1.6.20
  • security Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters in 1.6.20
  • security Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys in 1.6.20
  • security Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation in 1.6.20
  • security Security: Fix CSS scoping bypass in HTML messages using at-rules in 1.6.20
  • security Security: Fix bug where deprecated action aliases bypassed disabled_actions setting in 1.6.20
  • security Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action in 1.6.20
  • security Security: Fix CSRF validation bypass in the mark-as-junk action in 1.6.20
  • security Security: Fix XSS issue in handling of password driver error responses in 1.6.20
  • security Security: Fix mail header injection via subject of a message forwarded as attachment in 1.6.20
  • security Security: Fix mail header injection via media type in an inline image data URI in 1.6.20
  • security Security: Fix bug where Password Modoboa driver could change password for another account in 1.6.20
  • security Security: Fix unsafe use of a login name in SquirrelMail import file path in 1.6.20
  • security Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko in 1.6.19
  • security Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers in 1.6.19
  • security Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy in 1.6.19
  • security Security: Fix CSS declaration smuggling via un-encoded ampersand emission in 1.6.19
  • security Security: Fix CSS property injection via body background attribute in 1.6.19
  • security Security: Fix email header injection via bare CR in the subject field in 1.6.19
  • security Security: Fix email header injection via C-escape \r in the recipient display name in 1.6.19
  • security Security: Fix email header injection via identity's organization field in 1.6.19
  • security Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL in 1.6.19
  • security Security: Fix XSS in the HTML editor using text/enriched part content in 1.6.19
  • security Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book in 1.6.19
  • security Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL in 1.6.19
  • security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes in 1.6.19
  • security Security: Fix remote-content blocker bypass via SVG SMIL src animation in 1.6.19
  • security Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses in 1.6.19
  • security Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko in 1.6.18
  • security Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe in 1.6.18
  • security Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 in 1.6.18
  • security Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai in 1.6.18
  • security Security: Add basic validation for content proxied by the css proxy in 1.6.18
  • security Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets in 1.6.18
  • security Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check in 1.6.18
  • security Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute in 1.6.18
  • security Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter in 1.6.18
  • security Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions in 1.6.18
  • security Security: Fix RCE via cmd_learn driver of markasjunk plugin in 1.6.18
  • security Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization in 1.6.18
  • security Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host in 1.6.18
  • security Security: Fix stored XSS in "Add to address book" action in 1.6.18
  • security Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute in 1.6.18
  • security Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost. in 1.6.17
  • security Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit in 1.6.17
  • security Fix SSRF bypass via specific local address URLs - two new cases, reported by Leenear. in 1.6.17
  • security Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR). in 1.6.17
  • security Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) in 1.6.17
  • security Security: Fix various vulnerabilities in the password plugin using session-injected username in 1.6.17
  • security Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432] in 1.6.17
  • security Security: Fix SSRF bypass via specific local address URLs - two new cases in 1.6.17
  • security Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433] in 1.6.17
  • security Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file in 1.6.17
  • security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.6.16
  • security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.6.16
  • security Fix SSRF bypass via specific local address URLs in 1.6.16
  • security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.6.16
  • security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.6.16
  • security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.6.16
  • security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.6.16
  • security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.6.16
  • security Security: Fix SSRF bypass via specific local address URLs in 1.6.16
  • security Security: Fix bypass of remote image blocking via CSS var() in 1.6.16
  • security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.6.16
  • security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.6.16
  • security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.6.16
  • security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.6.14
  • security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.6.14
  • security Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. in 1.6.14
  • security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.6.14
  • security Security: Fix bug where a password could get changed without providing the old password in 1.6.14
  • security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.6.14
  • security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.6.14
  • security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.6.14
  • security Security: Fix fixed position mitigation bypass via use of !important in 1.6.14
  • security Security: Fix XSS issue in a HTML attachment preview in 1.6.14
  • security Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts in 1.6.14
  • security Fix CSS injection vulnerability reported by CERT Polska. in 1.6.13
  • security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
  • security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
  • security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
  • security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
  • security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
  • security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11
  • security Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] in 1.6.8
  • security Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] in 1.6.8
  • security Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010] in 1.6.8
  • security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. in 1.6.7
  • security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. in 1.6.7
  • security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes in 1.6.7
  • security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences in 1.6.7
  • security Update to TinyMCE 5.10.9 security release (#9228) in 1.6.6
  • security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec). in 1.6.5
  • security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download in 1.6.5
  • security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko. in 1.6.4
  • security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.6.4
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.6.3
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.6.3
  • security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.5.14
  • security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.5.14
  • security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.5.14
  • security Security: Fix bug where a password could get changed without providing the old password in 1.5.14
  • security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.5.14
  • security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.5.14
  • security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.5.14
  • security Security: Fix fixed position mitigation bypass via use of !important in 1.5.14
  • security Security: Fix XSS issue in a HTML attachment preview in 1.5.14
  • security Fix CSS injection vulnerability reported by CERT Polska. in 1.5.13
  • security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.5.12
  • security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.5.12
  • security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.5.10
  • security Fix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009] in 1.5.8
  • security Fix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008] in 1.5.8
  • security Fix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010] in 1.5.8
  • security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike. in 1.5.7
  • security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật. in 1.5.7
  • security Fix cross-site scripting (XSS) vulnerability in handling SVG animate attributes in 1.5.7
  • security Fix cross-site scripting (XSS) vulnerability in handling list columns from user preferences in 1.5.7
  • security Fix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec). in 1.5.6
  • security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.5.5
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.5.4
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.5.4
  • security Cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.5.2
  • security Security: fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.5.2
  • security Fix bug where attachment download could sometimes fail with a CSRF check error (#8283) in 1.5.1
  • security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193) in 1.5.0
  • security Fix SQL injection via some session variables in 1.5.0
  • security Fix security issues regarding server name and trusted_host_patterns setting in 1.5.0
  • security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko. in 1.4.15
  • security Fix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) in 1.4.15
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar. in 1.4.14
  • security Fix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages in 1.4.14
  • security Cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.13
  • security Security: fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.13
  • security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning in 1.4.12
  • security Fix possible SQL injection via some session variables in 1.4.12
  • security Fix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193) in 1.4.12
  • security Fix SQL injection via some session variables in 1.4.12
  • security Fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.11
  • security Security: Fix cross-site scripting (XSS) via HTML messages with malicious CSS content in 1.4.11
  • security Stored cross-site scripting (XSS) via HTML or plain text messages with malicious content [CVE-2020-35730] in 1.4.10
  • security Security: Fix cross-site scripting (XSS) via HTML or plain text messages with malicious content in 1.4.10
  • security Fix potential XSS issue in HTML editor of the identity signature input in 1.4.8
  • security Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145] in 1.4.8
  • security Fix cross-site scripting (XSS) via HTML messages with malicious math content in 1.4.8
  • security Security: Fix potential XSS issue in HTML editor of the identity signature input (#7507) in 1.4.8
  • security Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145] in 1.4.8
  • security Security: Fix cross-site scripting (XSS) via HTML messages with malicious math content in 1.4.8
  • security Prevent cross-site scripting (XSS) via HTML messages with malicious svg/namespace (CVE-2020-15562) in 1.4.7
  • security Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace in 1.4.7
  • security Fix XSS issue in template object 'username' (#7406) in 1.4.5
  • security Fix cross-site scripting (XSS) via malicious XML attachment in 1.4.5
  • security Fix a couple of XSS issues in Installer (#7406) in 1.4.5
  • security Better fix for CVE-2020-12641 in 1.4.5
  • security Security: Fix a couple of XSS issues in Installer (#7406) in 1.4.5
  • security Security: Fix XSS issue in template object 'username' (#7406) in 1.4.5
  • security Security: Fix cross-site scripting (XSS) via malicious XML attachment in 1.4.5
  • security Security: Better fix for CVE-2020-12641 in 1.4.5
  • security Cross-Site Scripting (XSS) via malicious HTML content in 1.4.4
  • security CSRF attack can cause an authenticated user to be logged out in 1.4.4
  • security Remote code execution via crafted config options in 1.4.4
  • security Path traversal vulnerability allowing local file inclusion via crafted 'plugins' option in 1.4.4
  • security Security: Fix XSS issue in handling of CDATA in HTML messages in 1.4.4
  • security Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings in 1.4.4
  • security Security: Fix local file inclusion (and code execution) via crafted 'plugins' option in 1.4.4
  • security Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302) in 1.4.4

Deprecations

  • deprecated Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5
  • deprecated Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.6.20
  • deprecated Fix PHP8 deprecation warning in the reconnect plugin (#9083) in 1.6.3
  • deprecated Fix deprecated use of ldap_connect() in password's ldap_simple driver (#9060) in 1.6.3

Every release in between

1.7.5 Oct 19, 2026 Release notes ↗
fixFix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K.
fixFix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe.
featureAdd a size limit to the CSS proxy content processing, reported by Milan Hoppe.
securityFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
fixFix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe.
fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe.
fixFix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo
fixFix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay.
fixFix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy.
fixFix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys, reported by Oli Z.
fixFix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW.
fixFix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW.
deprecatedFix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix mail header injection via subject of a message forwarded as attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix mail header injection via media type in an inline image data URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix bug where Password Modoboa driver could change password for another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
featureInstaller: Add possibility to detsroy the installer session/cookie
securitySecurity: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
securitySecurity: Fix bug where an alias login wasn't qualified by IMAP host
securitySecurity: Add a size limit to the CSS proxy content processing
securitySecurity: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
securitySecurity: Fix remote content blocking bypass via SVG SMIL by attribute
securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
securitySecurity: Fix passing potentally unsafe attachment content into ImageMagick on image resize
securitySecurity: Fix mail header injection via the From display-name in the Bounce (resend) action
securitySecurity: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
securitySecurity: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
securitySecurity: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
securitySecurity: Fix CSS scoping bypass in HTML messages using at-rules
securitySecurity: Fix bug where deprecated action aliases bypassed disabled_actions setting
securitySecurity: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
securitySecurity: Fix CSRF validation bypass in the mark-as-junk action
securitySecurity: Fix XSS issue in handling of password driver error responses
securitySecurity: Fix mail header injection via subject of a message forwarded as attachment
securitySecurity: Fix mail header injection via media type in an inline image data URI
securitySecurity: Fix bug where Password Modoboa driver could change password for another account
securitySecurity: Fix unsafe use of a login name in SquirrelMail import file path
+5 more items in the release notes
1.7.4 Sep 6, 2026 Release notes ↗
fixFix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai
fixFix CSS property injection via body background attribute, reported by zenithhostingevan
fixFix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo
fixFix email header injection via C-escape \r in the recipient display name, reported by dogeshark
fixFix email header injection via identity's organization field, reported by dogeshark
securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
fixFix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers
fixFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337
fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by Wahab KHADIR
fixFix remote-content blocker bypass via SVG SMIL src animation
securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy
otherUse X-Content-Type-Options:nosniff for attachment previews and downloads (#10308)
fixzipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
securitySecurity: Fix CSS declaration smuggling via un-encoded ampersand emission
securitySecurity: Fix CSS property injection via body background attribute
securitySecurity: Fix email header injection via bare CR in the subject field
securitySecurity: Fix email header injection via C-escape \r in the recipient display name
securitySecurity: Fix email header injection via identity's organization field
securitySecurity: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
securitySecurity: Fix XSS in the HTML editor using text/enriched part content
securitySecurity: Fix cross-user access in contact group membership (add/remove) in the SQL address book
securitySecurity: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
securitySecurity: Fix remote-content blocker bypass via SVG SMIL src animation
securitySecurity: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses
1.7.3 Aug 9, 2026 Release notes ↗
featureAdd basic validation for content proxied by the css proxy
securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
fixFix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe
fixFix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter, reported by Milan Hoppe
fixFix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions, reported by Milan Hoppe
securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
fixFix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai
fixFix password's modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun
securityFix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai
fixFix HTML/CSS sanitization bypass via SVG animate by attribute, reported by vectrain
otherOAuth: Don't log an error when a refreshed token's TTL is below refresh_interval (#10213)
fixFix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
fixFix bug where searching in example_addressbook plugin was reporting zero results despite matches (#9022)
fixFix vCard import mis-detecting folded continuation lines as BEGIN/END:VCARD (#9593)
fixFix bug where the php session driver practically disabled session.lazy_write optimization (#9885, #10248)
fixFix bug where dates could get displayed shifted back one day in some places (#9403)
fixFix regression where it wasn't possible to hide a skin logo image anymore (#10254)
fixFix decoding of multi-segment RFC2231 extended attachment filenames (#10268)
fixFix vCard import silently dropping properties with a non-item group prefix (#10271)
fixFix so REQUEST_URI is used as a fallback if PATH_INFO is empty in static.php (#10181)
securitySecurity: Add basic validation for content proxied by the css proxy
securitySecurity: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
securitySecurity: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
securitySecurity: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
securitySecurity: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
securitySecurity: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
securitySecurity: Fix RCE via cmd_learn driver of markasjunk plugin
securitySecurity: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
securitySecurity: Fix password's modoboa driver leak of an authentication token to a user-controlled host
securitySecurity: Fix stored XSS in "Add to address book" action
securitySecurity: Fix HTML/CSS sanitization bypass via SVG animate by attribute.
1.7.2 Jul 5, 2026 Release notes ↗
fixFix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.
securityFix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
securityFix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
securityFix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.
securityFix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR).
fixFix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file, reported by h0rk1p.
featureAdd HEAD request handler to the static.php
fixFix so the oauth_password_claim claim is retrieved via token or userinfo request (#9631)
fixFix bug where static.php would return a 416 error on a specific Range request (#10194)
fixFix bug where configured skin logo wasn't loaded via static.php resulting in 404 error (#10191)
fixFix bug where installto.sh would fail if public_html folder does not exist in the target directory (#10202)
otherRevert "Prefer 8bit over quoted-printable for HTML parts, when force_7bit is disabled (#8477)" (#10198)
fixFix incorrect unfolding of folded lines when importing vCard 2.1 contacts (#9647)
fixFix bug where Imagick could leave large temporary files on failure (#10230)
fixFix bug where redis/memcache session could have been updated more often than needed
fixFix support for untyped tokens in OIDC backchannel logout, require unset nonce (#10097)
securitySecurity: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
securitySecurity: Fix various vulnerabilities in the password plugin using session-injected username
securitySecurity: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
securitySecurity: Fix SSRF bypass via specific local address URLs - two new cases
securitySecurity: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
securitySecurity: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file
1.7.1 May 24, 2026 Release notes ↗
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
fixFix CSS injection bypass in HTML sanitizer via SVG , reported by wooseokdotkim
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
securityFix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team
fixFix bypass of remote image blocking via CSS var(), reported by Geame
fixFix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1
securityFix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri
otherEnigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
fixManagesieve: Fix error when a mail message contains duplicate List-Id header (#10186)
otherClarified Elastic installation instructions (#10163)
featureAdded HTMLFormElement.requestSubmit() polyfill for older browsers (#10179)
fixFix so "has:attachment" search uses $HasAttachment/$HasNoAttachment keywords (#10168)
fixFix potential too long value in IMAP ID command (#10136)
fixFix redis/memcache disconnection in rcube::sleep() (#10127)
fixFix so static resources, e.g. skin_logo can be put inside the public_html directory (#10160)
fixFix so REQUEST_URI is used as a fallback if PATH_INFO is not set in static.php (#10181)
fixFix assets_path feature and remove dependency on PATH_INFO (#10185)
fixFix MySQL upgrade on MySQL < 8.0 and MariaDB < 10.5.3 (#10188)
securitySecurity: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog
securitySecurity: Fix CSS injection bypass in HTML sanitizer via SVG
securitySecurity: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass
securitySecurity: Fix SSRF bypass via specific local address URLs
securitySecurity: Fix bypass of remote image blocking via CSS var()
securitySecurity: Fix local/private URL fetch bypass when remote resources were not allowed
securitySecurity: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass
securitySecurity: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option
1.7.0 May 10, 2026 Release notes ↗
otherMandatory public_html/ entry-point for HTTP servers, protecting all installations better.
featureImproved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout).
otherMarkdown mail rendering and composing.
otherA quick actions mouse-over menu on the messages list.
otherAdvanced mail search syntax.
breakingDropped support for PHP < 8.1.
breakingDropped support for Internet Explorer.
breakingDropped support for MS SQL Server and Oracle.
breakingpublic_html/ entry-point made mandatory, all static resources are served via public_html/static.php.
breakingRemoved apc cache driver (replaced by apcu cache driver).
breakingChanged smtp_log option default value to false.
breakingRemoved contact_search_name option in favor of contactlist_name_template.
breakingReplaced session property changed by expires_at.
breakingRemoved the (insecure) virtualmin password driver.
otherBump OpenPGPjs version to 6.3.0
featureAllow cidr (subnets) in proxy_whitelist (#7103)
fixZipdownload: Fix message date time zone in mbox export (#10147)
1.6.20 Oct 19, 2026 Release notes ↗
fixFix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K.
fixFix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe.
featureAdd a size limit to the CSS proxy content processing, reported by Milan Hoppe.
securityFix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
fixFix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe.
fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe.
fixFix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo
fixFix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay.
fixFix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy.
fixFix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys, reported by Oli Z.
fixFix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW.
fixFix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW.
deprecatedFix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securityFix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix mail header injection via subject of a message forwarded as attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix mail header injection via media type in an inline image data URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix bug where Password Modoboa driver could change password for another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
fixFix unsafe use of a login name in SquirrelMail import file path, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
securitySecurity: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action
securitySecurity: Fix bug where an alias login wasn't qualified by IMAP host
securitySecurity: Add a size limit to the CSS proxy content processing
securitySecurity: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
securitySecurity: Fix remote content blocking bypass via SVG SMIL by attribute
securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
securitySecurity: Fix passing potentally unsafe attachment content into ImageMagick on image resize
securitySecurity: Fix mail header injection via the From display-name in the Bounce (resend) action
securitySecurity: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
securitySecurity: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
securitySecurity: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
securitySecurity: Fix CSS scoping bypass in HTML messages using at-rules
securitySecurity: Fix bug where deprecated action aliases bypassed disabled_actions setting
securitySecurity: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
securitySecurity: Fix CSRF validation bypass in the mark-as-junk action
securitySecurity: Fix XSS issue in handling of password driver error responses
securitySecurity: Fix mail header injection via subject of a message forwarded as attachment
securitySecurity: Fix mail header injection via media type in an inline image data URI
securitySecurity: Fix bug where Password Modoboa driver could change password for another account
securitySecurity: Fix unsafe use of a login name in SquirrelMail import file path
1.6.19 Sep 6, 2026 Release notes ↗
fixFix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai
fixFix CSS property injection via body background attribute, reported by zenithhostingevan
fixFix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo
fixFix email header injection via C-escape \r in the recipient display name, reported by dogeshark
fixFix email header injection via identity's organization field, reported by dogeshark
securityFix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
securityFix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
fixFix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers
fixFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337
fixFix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by neoxed
fixFix remote-content blocker bypass via SVG SMIL src animation
securityFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy
fixFix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)
securitySecurity: Fix CSS declaration smuggling via un-encoded ampersand emission
securitySecurity: Fix CSS property injection via body background attribute
securitySecurity: Fix email header injection via bare CR in the subject field
securitySecurity: Fix email header injection via C-escape \r in the recipient display name
securitySecurity: Fix email header injection via identity's organization field
securitySecurity: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
securitySecurity: Fix XSS in the HTML editor using text/enriched part content
securitySecurity: Fix cross-user access in contact group membership (add/remove) in the SQL address book
securitySecurity: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
securitySecurity: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
securitySecurity: Fix remote-content blocker bypass via SVG SMIL src animation
securitySecurity: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses
1.6.18 Aug 9, 2026 Release notes ↗
featureAdd basic validation for content proxied by the css proxy
securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
fixFix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe
fixFix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter, reported by Milan Hoppe
fixFix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions, reported by Milan Hoppe
securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
fixFix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai
fixFix password's modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun
securityFix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai
fixFix HTML/CSS sanitization bypass via SVG animate by attribute, reported by vectrain
fixPassword: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
fixFix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
securitySecurity: Add basic validation for content proxied by the css proxy
securitySecurity: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
securitySecurity: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
securitySecurity: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
securitySecurity: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter
securitySecurity: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions
securitySecurity: Fix RCE via cmd_learn driver of markasjunk plugin
securitySecurity: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
securitySecurity: Fix password's modoboa driver leak of an authentication token to a user-controlled host
securitySecurity: Fix stored XSS in "Add to address book" action
securitySecurity: Fix HTML/CSS sanitization bypass via SVG animate by attribute
1.6.17 Jul 5, 2026 Release notes ↗
fixFix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.
securityFix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
securityFix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
securityFix SSRF bypass via specific local address URLs - two new cases, reported by Leenear.
securityFix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR).
fixFix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file, reported by h0rk1p.
otherEnigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
otherEnigma: Kolab WOAT Support (#8626)
securitySecurity: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
securitySecurity: Fix various vulnerabilities in the password plugin using session-injected username
securitySecurity: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
securitySecurity: Fix SSRF bypass via specific local address URLs - two new cases
securitySecurity: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
securitySecurity: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file
1.6.16 May 24, 2026 Release notes ↗
securityFix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy)
fixFix CSS injection bypass in HTML sanitizer via SVG , reported by wooseokdotkim
securityFix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
securityFix SSRF bypass via specific local address URLs
securityFix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team
fixFix bypass of remote image blocking via CSS var(), reported by Geame
fixFix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1
securityFix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri
fixFix potential too long value in IMAP ID command (#10136)
securitySecurity: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog
securitySecurity: Fix CSS injection bypass in HTML sanitizer via SVG
securitySecurity: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass
securitySecurity: Fix SSRF bypass via specific local address URLs
securitySecurity: Fix bypass of remote image blocking via CSS var()
securitySecurity: Fix local/private URL fetch bypass when remote resources were not allowed
securitySecurity: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass
securitySecurity: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option
1.6.15 Mar 29, 2026 Release notes ↗
otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.
fixFix regression where mail search would fail on non-ascii search criteria (#10121)
fixFix regression where some data url images could get ignored/lost (#10128)
fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
1.6.14 Mar 18, 2026 Release notes ↗
fixFix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.
fixFix bug where a password could get changed without providing the old password, reported by flydragon777.
securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
fixFix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.
fixFix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.
fixFix fixed position mitigation bypass via use of !important, reported by nullcathedral.
securityFix XSS issue in a HTML attachment preview, reported by aikido_security.
securityFix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
fixFix Postgres connection using IPv6 address (#10104)
securitySecurity: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
securitySecurity: Fix bug where a password could get changed without providing the old password
securitySecurity: Fix IMAP Injection + CSRF bypass in mail search
securitySecurity: Fix remote image blocking bypass via various SVG animate attributes
securitySecurity: Fix remote image blocking bypass via a crafted body background attribute
securitySecurity: Fix fixed position mitigation bypass via use of !important
securitySecurity: Fix XSS issue in a HTML attachment preview
securitySecurity: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts
1.6.13 Feb 8, 2026 Release notes ↗
securityFix CSS injection vulnerability reported by CERT Polska.
fixFix remote image blocking bypass via SVG content reported by nullcathedral.
fixManagesieve: Fix handling of string-list format values for date tests in Out of Office (#10075)
1.6.12 Dec 14, 2025 Release notes ↗
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
otherSupport IPv6 in database DSN (#9937)
otherDon't force specific error_reporting setting
fixFix compatibility with PHP 8.5 regarding array_first()
securityRemove X-XSS-Protection example from .htaccess file (#9875)
fixFix "Assign to group" action state after creation of a first group (#9889)
fixFix bug where contacts search would fail if contactlist_fields contained vcard fields (#9850)
fixFix bug where an mbox export file could include inconsistent message delimiters (#9879)
fixFix parsing of inline styles that aren't well-formatted (#9948)
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag
securityFix Information Disclosure vulnerability in the HTML style sanitizer
1.6.11 Jun 1, 2025 Release notes ↗
securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
fixManagesieve: Fix match-type selector (remove unsupported options) in delete header action (#9610)
otherImprove installer to fix confusion about disabling SMTP authentication (#9801)
fixFix PHP warning in index.php (#9813)
fixOAuth: Fix/improve token refresh
fixFix dark mode bug where wrong colors were used for blockquotes in HTML mail preview (#9820)
fixFix HTML message preview if it contains floating tables (#9804)
fixFix removing/expiring redis/memcache records when using a key prefix
fixFix bug where a wrong SPECIAL-USE folder could have been detected, if there were more than one per-type (#9781)
fixFix a default value and documentation of password_ldap_encodage option (#9658)
breakingRemove mobile/floating Create button from the list in Settings > Folders (#9661)
fixFix Delete and Empty buttons state while creating a folder (#9047)
fixFix connecting to LDAP using ldapi:// URI (#8990)
fixFix cursor position on "below the quote" reply in HTML mode (#8700)
fixFix bug where attachments with content type of application/vnd.ms-tnef were not parsed (#7119)
1.6.10 Feb 8, 2025 Release notes ↗
featureIMAP: Partial support for ANNOTATE-EXPERIMENT-1 extension (RFC 5257)
otherOAuth: Support standard authentication with short-living password received with OIDC token (#9530)
fixFix PHP warnings (#9616, #9611)
fixFix whitespace handling in vCard line continuation (#9637)
fixFix current script state after initial scripts creation in managesieve_kolab_master mode
fixFix rcube_imap::get_vendor() result (and PHP warning) on Zimbra server (#9650)
fixFix regression causing inline SVG images to be missing in mail preview (#9644)
fixFix plugin "virtuser_file" to handle backward slashes in username (#9668)
fixFix PHP fatal error when parsing some malformed BODYSTRUCTURE responses (#9689)
fixFix insert_or_update() and reading database server config on PostgreSQL (#9710)
fixFix Oauth issues with use_secure_urls=true (#9722)
fixFix handling of binary mail parts (e.g. PDF) encoded with quoted-printable (#9728)
fixFix links in comments and config to https:// where available (#9759, #9756)
fixFix decoding of attachment names encoded using both RFC2231 and RFC2047 standards (#9725)
1.6.9 Sep 1, 2024 Release notes ↗
fixFix regression where printing/scaling/rotating image attachments was broken (#9571)
fixFix regression where HTML messages were displayed unstyled (#9586)
1.6.8 Aug 4, 2024 Release notes ↗
securityFix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
securityFix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
securityFix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
otherManagesieve: Protect special scripts in managesieve_kolab_master mode
fixFix newmail_notifier notification focus in Chrome (#9467)
fixFix fatal error when parsing some TNEF attachments (#9462)
fixFix double scrollbar when composing a mail with many plain text lines (#7760)
fixFix decoding mail parts with multiple base64-encoded text blocks (#9290)
fixFix bug where some messages could get malformed in an import from a MBOX file (#9510)
fixFix invalid line break characters in multi-line text in Sieve scripts (#9543)
fixFix bug where "with attachment" filter could fail on some fts engines (#9514)
fixFix bug where an unhandled exception was caused by an invalid image attachment (#9475)
fixFix bug where a long subject title could not be displayed in some cases (#9416)
fixFix infinite loop when parsing malformed Sieve script (#9562)
fixFix bug where imap_conn_option's 'socket' was ignored (#9566)
1.6.7 May 19, 2024 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike.
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật.
fixFix command injection via crafted im_convert_path/im_identify_path on Windows. Reported by Huy Nguyễn Phạm Nhật.
otherMakefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
fixFix bug where HTML entities in URLs were not decoded on HTML to plain text conversion (#9312)
fixFix bug in collapsing/expanding folders with some special characters in names (#9324)
fixFix PHP8 warnings (#9363, #9365, #9429)
fixFix missing field labels in CSV import, for some locales (#9393)
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
fixFix command injection via crafted im_convert_path/im_identify_path on Windows
1.6.6 Jan 20, 2024 Release notes ↗
fixFix regression in handling LDAP search_fields configuration parameter (#9210)
fixEnigma: Fix finding of a private key when decrypting a message using GnuPG v2.3
fixFix page jump menu flickering on click (#9196)
securityUpdate to TinyMCE 5.10.9 security release (#9228)
fixFix PHP8 warnings (#9235, #9238, #9242, #9306)
fixFix saving other encryption settings besides enigma's (#9240)
fixFix unneeded php command use in installto.sh and deluser.sh scripts (#9237)
fixFix TinyMCE localization installation (#9266)
breakingFix bug where trailing non-ascii characters in email addresses could have been removed in recipient input (#9257)
fixFix IMAP GETMETADATA command with options - RFC5464
1.6.5 Nov 5, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec).
fixFix PHP8 fatal error when parsing a malformed BODYSTRUCTURE (#9171)
fixFix duplicated Inbox folder on IMAP servers that do not use Inbox folder with all capital letters (#9166)
fixFix PHP warnings (#9174)
fixFix UI issue when dealing with an invalid managesieve_default_headers value (#9175)
fixFix bug where images attached to application/smil messages weren't displayed (#8870)
fixFix PHP string replacement error in utils/error.php (#9185)
fixFix regression where smtp_user did not allow pre/post strings before/after %u placeholder (#9162)
securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download
1.6.4 Oct 16, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko.
fixFix PHP8 warnings (#9142, #9160)
fixFix default 'mime.types' path on Windows (#9113)
fixManagesieve: Fix javascript error when relational or spamtest extension is not enabled (#9139)
securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)
1.6.3 Sep 15, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar.
fixFix bug where installto.sh/update.sh scripts were removing some essential options from the config file (#9051)
otherUpdate jQuery-UI to version 1.13.2 (#9041)
fixFix regression that broke use_secure_urls feature (#9052)
fixFix potential PHP fatal error when opening a message with message/rfc822 part (#8953)
fixFix bug where a duplicate tag in HTML email could cause some parts being cut off (#9029)
fixFix bug where a list of folders could have been sorted incorrectly (#9057)
fixFix regression where LDAP addressbook 'filter' option was ignored (#9061)
fixFix wrong order of a multi-folder search result when sorting by size (#9065)
fixFix so install/update scripts do not require PEAR (#9037)
fixFix regression where some mail parts could have been decoded incorrectly, or not at all (#9096)
fixFix handling of an error case in Cyrus IMAP BINARY FETCH, fallback to non-binary FETCH (#9097)
deprecatedFix PHP8 deprecation warning in the reconnect plugin (#9083)
fixFix "Show source" on mobile with x_frame_options = deny (#9084)
fixFix various PHP warnings (#9098)
deprecatedFix deprecated use of ldap_connect() in password's ldap_simple driver (#9060)
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages
1.6.2 Jul 2, 2023 Release notes ↗
featureAdd Uyghur localization
fixFix regression in OAuth request URI caused by use of REQUEST_URI instead of SCRIPT_NAME as a default (#8878)
fixFix bug where false attachment reminder was displayed on HTML mail with inline images (#8885)
fixFix bug where a non-ASCII character in app.js could cause error in javascript engine (#8894)
fixFix JWT decoding with url safe base64 schema (#8890)
fixFix bug where .wav instead of .mp3 file was used for the new mail notification in Firefox (#8895)
fixFix PHP8 warning (#8891)
fixFix support for Windows-31J charset (#8869)
fixFix so LDAP VLV option is disabled by default as documented (#8833)
fixFix so an email address with name is supported as input to the managesieve notify :from parameter (#8918)
fixFix Help plugin menu (#8898)
fixFix invalid onclick handler on the logo image when using non-array skin_logo setting (#8933)
fixFix duplicate recipients in "To" and "Cc" on reply (#8912)
fixFix bug where it wasn't possible to scroll lists by clicking middle mouse button (#8942)
fixFix bug where label text in a single-input dialog could be partially invisible in some locales (#8905)
fixFix bug where LDAP (fulltext) search didn't work without 'search_fields' in config (#8874)
fixFix extra leading newlines in plain text converted from HTML (#8973)
fixFix so recipients with a domain ending with .s are allowed (#8854)
fixFix so vCard output does not contain non-standard/redundant TYPE=OTHER and TYPE=INTERNET (#8838)
fixFix QR code images for contacts with non-ASCII characters (#9001)
fixFix PHP8 warnings when using list_flags and list_cols properties by plugins (#8998)
fixFix bug where subfolders could loose subscription on parent folder rename (#8892)
fixFix connecting to LDAP using an URI with ldapi:// scheme (#8990)
fixFix insecure shell command params handling in cmd_learn driver of markasjunk plugin (#9005)
fixFix bug where some mail headers didn't work in cmd_learn driver of markasjunk plugin (#9005)
fixFix PHP fatal error when importing vcf file using PHP 8.2 (#9025)
fixFix so output of log_date_format with microseconds contains time in server time zone, not UTC
1.6.1 Jan 23, 2023 Release notes ↗
otherKill session if refreshing oauth token fails (#8734)
fixFix various PHP 8.1 warnings (#8628, #8644, #8667, #8656, #8647)
breakingPassword: Remove references to %c variable that has been removed before (#8633)
fixFix anchor links in HTML mail (#8632)
fixFix bug where config creation in Installer did ignore options in the form (#8634)
breakingFix bug where renamed options were removed from the config on installto.sh (update.sh) run (#8643)
fixFix favicon rewrite rule in .htaccess (#8654)
fixFix various PHP 8.2 warnings
fixFix bug where it wasn't possible to create more than one response record on SQLite and Postgres (#8664)
fixFix support for ManageSieve over implicit SSL (#8670)
fixFix bug where "about:blank" page could trigger "load error" (#8554)
fixFix bug where setting 'Clear Trash on Logout' to 'all messages' didn't work (#8687)
fixFix bug where the attachment menu wouldn't disappear after an action is selected (#8691)
fixFix bug where some dialogs in an eml attachment preview would not close on mobile (#8627)
fixFix bug where multiline data:image URI's in emails were stripped from the message on display (#8613)
fixFix fatal error on identity page if Enigma plugin is misconfigured (#8719)
fixFix so N property always exists in a vCard export (#8771)
fixFix authenticating to Courier IMAP with passwords containing a '~' character (#8772)
fixFix handling of smtp/imap port options on configuration file update (#8756)
fixFix bug where array values could not be saved in utils/save_pref action (#8781)
featureAdd workaround for using Roundcube behind a reverse proxy with a subpath: 'request_path' option (#8738, #8770)
fixFix bug where "Invalid skin name" error was logged on preferences save if there's only one skin (#8825)
fixFix SIGBUS raised in ImageMagick when more than one process tried to generate a thumbnail of the same image attachment (#8511)
fixFix bug where updater does not update the vendor packages (#8642)
fixFix missing mail composing textarea on reply/draft with a long plain text content (#8866)
1.6.0 Jul 28, 2022 Release notes ↗
otherPHP 8.1 support
breakingDropped support for PHP < 7.3
otherSupport responses (snippets) in HTML format
otherOption to purge deleted mails older than 30, 60 or 90 days
otherUnified and simplified services connection config options
breakingRemoved the Classic and Larry skins from the release packages
otherSQLite: Use foreign keys, require SQLite >= 3.6.19
breakingIMAP:
breakingrenamed default_host to imap_host
breakingremoved default_port option (non-standard port can be set via imap_host)
breakingset "localhost:143" as a default for imap_host
breakingSMTP:
breakingrenamed smtp_server to smtp_host
breakingremoved smtp_port option (non-standard port can be set via smtp_host)
breakingset "localhost:587" as a default for smtp_host
breakingLDAP:
breakingremoved port option from ldap_public array (non-standard port can be set via host)
breakingremoved use_tls option from ldap_public array (use tls:// prefix in host)
breakingManagesieve:
breakingremoved managesieve_port option (non-standard port can be set via managesieve_host)
breakingremoved managesieve_usetls option (set tls:// prefix to managesieve_host)
fixFix SMTP XCLIENT extension when not using STARTTLS (#8581)
fixFix call to undefined method rcube_ldap_generic::option_set() (#8564)
breakingFix PHP Fatal error on incompatible method declaration of rcmail_output_json::command() and rcmail_output::command() (#8579)
fixFix support for DSN specification without host e.g. pgsql:///dbname (#8558)
fixFix TinyMCE configuration for handling styles of pasted content in webkit browsers (#8555)
fixFix bug where some checkboxes could be selected unintentinally (#8565)
fixFix css styles of the email recipient element while dragging (#8580)
fixFix PHP 8.1 warnings in the LDAP backend code (#8572)
fixFix various PHP 8.1 warnings (#8584)
fixFix bug where a recipient address containing UTF-8 characters was ignored when sending an email (#8493, #8546)
fixFix so rcmail::contact_exists() works with IDNA addresses (#8545)
fixFix password option in storage_init hook after refreshing oauth access token (#8436)
fixFix attachment Options popover menu after attachment delete (#8602)
fixFix so "Found unconstructed Spoofchecker" error is not fatal (#8537)
1.5.15 Mar 29, 2026 Release notes ↗
otherSVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.
fixFix so distribution packages (and composer.json) don't include development dependencies
fixFix regression where mail search would fail on non-ascii search criteria (#10121)
fixFix regression where some data url images could get ignored/lost (#10128)
fixFix SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke
1.5.14 Mar 18, 2026 Release notes ↗
fixFix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.
fixFix bug where a password could get changed without providing the old password, reported by flydragon777.
securityFix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
fixFix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.
fixFix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.
fixFix fixed position mitigation bypass via use of !important, reported by nullcathedral.
securityFix XSS issue in a HTML attachment preview, reported by aikido_security.
securitySecurity: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler
securitySecurity: Fix bug where a password could get changed without providing the old password
securitySecurity: Fix IMAP Injection + CSRF bypass in mail search
securitySecurity: Fix remote image blocking bypass via various SVG animate attributes
securitySecurity: Fix remote image blocking bypass via a crafted body background attribute
securitySecurity: Fix fixed position mitigation bypass via use of !important
securitySecurity: Fix XSS issue in a HTML attachment preview
1.5.13 Feb 8, 2026 Release notes ↗
securityFix CSS injection vulnerability reported by CERT Polska.
fixFix remote image blocking bypass via SVG content reported by nullcathedral.
1.5.12 Dec 14, 2025 Release notes ↗
securityFix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike.
securityFix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.
1.5.11 Jun 15, 2025 Release notes ↗
otherThis is the next service release to update the LTS version 1.5 of Roundcube.
fixIt only fixes a compatibility issue with PHP 5.5 that slipped into the previous (1.5.10) release.
otherThis release is considered stable and if you was not able to upgrade to 1.5.10 you should update now.
1.5.10 Jun 1, 2025 Release notes ↗
securityFix Post-Auth RCE via PHP Object Deserialization reported by firs0v.
fixFix current script state after initial scripts creation in managesieve_kolab_master mode
fixFix regression causing inline SVG images to be missing in mail preview (#9644)
1.5.9 Sep 1, 2024 Release notes ↗
fixFix regression where printing/scaling/rotating image attachments was broken (#9571)
fixFix regression where HTML messages were displayed unstyled (#9586)
1.5.8 Aug 4, 2024 Release notes ↗
securityFix XSS vulnerability in post-processing of sanitized HTML content [CVE-2024-42009]
securityFix XSS vulnerability in serving of attachments other than HTML or SVG [CVE-2024-42008]
securityFix information leak (access to remote content) via insufficient CSS filtering [CVE-2024-42010]
1.5.7 May 19, 2024 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes. Reported by Valentin T. and Lutz Wolf of CrowdStrike.
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences. Reported by Huy Nguyễn Phạm Nhật.
fixFix command injection via crafted im_convert_path/im_identify_path on Windows. Reported by Huy Nguyễn Phạm Nhật.
fixEnigma: Fix finding of a private key when decrypting a message using GnuPG v2.3
fixFix TinyMCE localization installation (#9266)
otherMakefile: Use phpDocumentor v3.4 for the Framework docs (#9313)
securityFix cross-site scripting (XSS) vulnerability in handling SVG animate attributes
securityFix cross-site scripting (XSS) vulnerability in handling list columns from user preferences
fixFix command injection via crafted im_convert_path/im_identify_path on Windows
1.5.6 Nov 5, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in setting Content-Type/Content-Disposition for attachment preview/download reported by Rene Rehme (rehme.infosec).
1.5.5 Oct 16, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)
1.5.4 Sep 18, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar.
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages
fixFix so output of log_date_format with microseconds contains time in server time zone, not UTC
fixFix so N property always exists in a vCard export (#8771)
fixFix so rcmail::format_date() works with DateTimeImmutable input (#8867)
fixFix bug where a non-ASCII character in app.js could cause error in javascript engine (#8894)
1.5.3 Jun 26, 2022 Release notes ↗
fixEnigma: Fix initial synchronization of private keys
fixEnigma: Fix double quoted-printable encoding of pgp-signed messages with no attachments (#8413)
fixFix various PHP8 warnings (#8392)
fixFix mail headers injection via the subject field on mail compose (#8404)
fixFix bug where small message/rfc822 parts could not be decoded (#8408)
fixFix setting HTML mode on reply/forward of a signed message (#8405)
fixFix handling of RFC2231-encoded attachment names inside of a message/rfc822 part (#8418)
fixFix bug where some mail parts (images) could have not be listed as attachments (#8425)
fixFix bug where attachment icons were stuck at the top of the messages list in Safari (#8433)
fixFix handling of message/rfc822 parts that are small and are multipart structures with a single part (#8458)
fixFix bug where session could time out if DB and PHP timezone were different (#8303)
fixFix bug where DSN flag state wasn't stored with a draft (#8371)
fixFix broken encoding of HTML content encapsulated in a RTF attachment (#8444)
fixFix problem with aria-hidden=true on toolbar menus in the Elastic skin (#8517)
fixFix bug where title tag content was displayed in the body if it contained HTML tags (#8540)
fixFix support for DSN specification without host e.g. pgsql:///dbname (#8558)
1.5.2 Dec 30, 2021 Release notes ↗
securityCross-site scripting (XSS) via HTML messages with malicious CSS content
otherOAuth: pass 'id_token' to 'oauth_login' plugin hook (#8214)
fixOAuth: fix expiration of short-lived oauth tokens (#8147)
fixOAuth: fix relative path to assets if /index.php/foo/bar url is used (#8144)
otherOAuth: no auto-redirect on imap login failures (#8370)
otherOAuth: refresh access token in 'refresh' plugin hook (#8224)
fixFix so folder search parameters are honored by subscriptions_option plugin (#8312)
fixFix password change with Directadmin driver (#8322, #8329)
fixFix so css files in plugins/jqueryui/themes will be minified too (#8337)
fixFix handling of unicode/special characters in custom From input (#8357)
fixFix some PHP8 compatibility issues (#8363)
fixFix chpass-wrapper.py helper compatibility with Python 3 (#8324)
fixFix scrolling and missing Close button in the Select image dialog in Elastic/mobile (#8367)
securitySecurity: fix cross-site scripting (XSS) via HTML messages with malicious CSS content
1.5.1 Nov 28, 2021 Release notes ↗
fixFix importing contacts with no email address (#8227)
fixFix so session's search scope is not used if search is not active (#8199)
fixFix some PHP8 warnings (#8239)
fixFix so dark mode state is retained after closing the browser (#8237)
fixFix bug where new messages were not added to the list on refresh if skip_deleted=true (#8234)
fixFix colors on "Show source" page in dark mode (#8246)
fixFix handling of dark_mode_support:false setting in skins meta.json - also when devel_mode=false (#8249)
fixFix database initialization if db_prefix is a schema prefix (#8221)
fixFix undefined constant error in Installer on Windows (#8258)
fixFix installation/upgrade on MySQL 5.5 - Index column size too large (#8231)
fixFix regression in setting of contact listing name (#8260)
fixFix bug in Larry skin where headers toggle state was reset on full page preview (#8203)
fixFix bug where \u200b characters were added into the recipient input preventing mail delivery (#8269)
fixFix charset conversion errors on PHP < 8 for charsets not supported by mbstring (#8252)
fixFix bug where adding a contact to trusted senders via "Always allow from..." button didn't work (#8264, #8268)
fixFix bug with show_images setting where option 1 and 3 were swapped (#8268)
fixFix PHP fatal error on an undefined constant in contacts import action (#8277)
fixFix fetching headers of multiple message parts at once in rcube_imap_generic::fetchMIMEHeaders() (#8282)
securityFix bug where attachment download could sometimes fail with a CSRF check error (#8283)
fixFix an infinite loop when parsing environment variables with float/integer values (#8293)
fixFix so 'small-dark' logo has more priority than the 'small' logo (#8298)
1.5.0 Oct 18, 2021 Release notes ↗
otherDark mode for Elastic skin
otherOAuth2/XOauth support (with plugin hooks)
otherCollected recipients and trusted senders
otherMoving recipients between inputs with drag & drop
otherFull unicode support with MySQL database
otherSupport of IMAP LITERAL- extension [RFC 7888]
otherSupport of RFC 2231 encoded names
otherCache refactoring
otherbin/jsshrink.sh: replaced google-closure-compiler with UglifyJS
otherbin/cssshrink.sh: replaced yuicompressor with csso
featureElastic theme: require lessc >= 2.5.2 (and add support for v4) with less-plugin-clean-css
otherSupport displaying RTF content (including encapsulated HTML) from a TNEF attachment
otherDisable the default spellchecker option using spell.roundcube.net (#8182)
otherNewmail_notifier: Improved the notification sound (#8155)
fixFix size of Mailvelope iframe for PGP-inlined mail, again (#8126)
fixFix handling of group names with @ character in autocomplete and contacts widget (#8098)
fixFix Firefox infinate loading display on mail screen (#8128)
fixFix converting >1MB of HTML content into plain text (#8137)
fixFix bug where expanding a group in the recipient input could corrupt the input content (#7569)
fixFix fatal error/warning on invalid input to user parameter (#8152)
fixFix changing password with dovecot_passwdfile driver (#8145)
fixFix handling of headers that occur multiple times by show_additional_headers plugin (#8157)
fixFix bug where vertical scrollbar in new HTML message bounced back on scroll (#8046)
fixFix displaying inline images with incorrectly declared content-type (#8158)
fixFix so addr-spec with missing closing angle bracket can be parsed (#8164)
fixFix handling of spellcheck connection errors (#8172)
fixFix a couple of PHP8 warnings (#8175, #8176)
fixFix bug where "from my contacts" and "from trusted senders" values were mixed up (#8177)
fixFix password/token length check on OAuth login (#8178)
securityFix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193)
securityFix SQL injection via some session variables
fixFix handling of dark_mode_support:false setting in skins meta.json (#8186)
securityFix security issues regarding server name and trusted_host_patterns setting
1.4.15 Oct 16, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168) reported separately by Matthieu Faou (ESET) and Denys Klymenko.
securityFix cross-site scripting (XSS) vulnerability in handling of SVG in HTML messages (#9168)
fixFix PHP 5.4 compatibility by using pear-core-minimal 1.10.11 (#9148)
1.4.14 Sep 18, 2023 Release notes ↗
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages, reported by Niraj Shivtarkar.
securityFix cross-site scripting (XSS) vulnerability in handling of linkrefs in plain text messages
fixEnigma: Fix initial synchronization of private keys
1.4.13 Dec 30, 2021 Release notes ↗
securityCross-site scripting (XSS) via HTML messages with malicious CSS content
securitySecurity: fix cross-site scripting (XSS) via HTML messages with malicious CSS content
1.4.12 Nov 12, 2021 Release notes ↗
securityFix XSS issue in handling attachment filename extension in mimetype mismatch warning
securityFix possible SQL injection via some session variables
fixEnigma: Fix bug where signature verification could fail for non-ascii bodies (#7919)
fixFix bug where contacts search didn't work with addressbook_search_mods set to an empty array (#7974)
fixFix bug causing some HTML message content to be not centered in Elastic skin (#7911)
fixFix bug where consecutive LDAP searches could return wrong results (#8064)
fixFix bug where plus characters in attachment filename could have been ignored (#8074)
fixFix displaying HTML body with inline images encapsulated using TNEF format (winmail.dat)
fixFix handling of custom sender addresses with names (#8106)
fixFix shift + drag'n'drop menu not working in Elastic skin with Chrome browser (#8107)
fixFix Firefox infinite loading display on mail screen (#8128)
securityFix XSS issue in handling attachment filename extension in mimetype mismatch warning (#8193)
securityFix SQL injection via some session variables
1.4.11 Feb 8, 2021 Release notes ↗
securityFix cross-site scripting (XSS) via HTML messages with malicious CSS content
otherDisplay a nice error informing about no PHP8 support
fixElastic: Fix compatibility with Less v3 and v4 (#7813)
fixFix bug with managesieve_domains in Settings > Forwarding form (#7849)
fixFix errors in MSSQL database update scripts (#7853)
securitySecurity: Fix cross-site scripting (XSS) via HTML messages with malicious CSS content
1.4.10 Dec 27, 2020 Release notes ↗
securityStored cross-site scripting (XSS) via HTML or plain text messages with malicious content [CVE-2020-35730]
fixFix extra angle brackets in In-Reply-To header derived from mailto: params (#7655)
fixFix folder list issue when special folder is a subfolder (#7647)
fixFix Elastic's folder subscription toggle in search result (#7653)
fixFix state of subscription toggle on folders list after changing folder state from the search result (#7653)
securitySecurity: Fix cross-site scripting (XSS) via HTML or plain text messages with malicious content
1.4.9 Sep 27, 2020 Release notes ↗
fixFix HTML editor in latest Chrome 85.0.4183.102, update to TinyMCE 4.9.11 (#7615)
featureAdd missing localization for some label/legend elements in userinfo plugin (#7478)
fixFix importing birthday dates from Gmail vCards (BDAY:YYYYMMDD)
fixFix restoring Cc/Bcc fields from local storage (#7554)
fixFix jstz.min.js installation, bump version to 1.0.7
fixFix incorrect PDO::lastInsertId() use in sqlsrv driver (#7564)
fixFix link to closure compiler in bin/jsshrink.sh script (#7567)
fixFix bug where some parts of a message could have been missing in a reply/forward body (#7568)
fixFix empty space on mail printouts in Chrome (#7604)
fixFix empty output from HTML5 parser when content contains XML tag (#7624)
fixFix scroll jump on key press in plain text mode of the HTML editor (#7622)
fixFix so autocompletion list does not hide on scroll inside it (#7592)
1.4.8 Aug 10, 2020 Release notes ↗
securityFix potential XSS issue in HTML editor of the identity signature input
securityFix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
securityFix cross-site scripting (XSS) via HTML messages with malicious math content
fixManagesieve: Fix too-small input field in Elastic when using custom headers (#7498)
fixFix support for an error as a string in message_before_send hook (#7475)
fixElastic: Fix redundant scrollbar in plain text editor on mail reply (#7500)
fixElastic: Fix deleted and replied+forwarded icons on messages list (#7503)
featureManagesieve: Allow angle brackets in out-of-office message body (#7518)
fixFix bug in conversion of email addresses to mailto links in plain text messages (#7526)
fixFix format=flowed formatting on plain text part derived from the HTML content (#7504)
fixFix incorrect rewriting of internal links in HTML content (#7512)
fixFix handling links without defined protocol (#7454)
fixFix paging of search results on IMAP servers with no SORT capability (#7462)
fixFix detecting special folders on servers with both SPECIAL-USE and LIST-STATUS (#7525)
securitySecurity: Fix potential XSS issue in HTML editor of the identity signature input (#7507)
securitySecurity: Fix cross-site scripting (XSS) via HTML messages with malicious svg content [CVE-2020-16145]
securitySecurity: Fix cross-site scripting (XSS) via HTML messages with malicious math content
1.4.7 Jul 5, 2020 Release notes ↗
securityPrevent cross-site scripting (XSS) via HTML messages with malicious svg/namespace (CVE-2020-15562)
fixFix bug where subfolders of special folders could have been duplicated on folder list
otherIncrease maximum size of contact jobtitle and department fields to 128 characters
fixFix missing newline after the logged line when writing to stdout (#7418)
fixElastic: Fix context menu (paste) on the recipient input (#7431)
fixFix problem with forwarding inline images attached to messages with no HTML part (#7414)
fixFix problem with handling attached images with same name when using database_attachments/redundant_attachments (#7455)
securitySecurity: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace
1.4.6 Jun 7, 2020 Release notes ↗
fixInstaller: Fix regression in SMTP test section (#7417)
1.4.5 Jun 2, 2020 Release notes ↗
securityFix XSS issue in template object 'username' (#7406)
securityFix cross-site scripting (XSS) via malicious XML attachment
securityFix a couple of XSS issues in Installer (#7406)
securityBetter fix for CVE-2020-12641
fixFix bug in extracting required plugins from composer.json that led to spurious error in log (#7364)
fixFix so the database setup description is compatible with MySQL 8 (#7340)
fixMarkasjunk: Fix regression in jsevent driver (#7361)
fixFix missing flag indication on collapsed thread in Larry and Elastic (#7366)
fixFix default keyservers (use keys.openpgp.org), add note about CORS (#7373, #7367)
fixPassword: Fix issue with Modoboa driver (#7372)
otherMailvelope: Use sender's address to find pubkeys to check signatures (#7348)
fixMailvelope: Fix Encrypt button hidden in Elastic (#7353)
fixFix PHP warning: count(): Parameter must be an array or an object... in ID command handler (#7392)
fixFix error when user-configured skin does not exist anymore (#7271)
fixElastic: Fix aspect ratio of a contact photo in mail preview (#7339)
fixFix bug where PDF attachments marked as inline could have not been attached on mail forward (#7382)
securitySecurity: Fix a couple of XSS issues in Installer (#7406)
securitySecurity: Fix XSS issue in template object 'username' (#7406)
securitySecurity: Fix cross-site scripting (XSS) via malicious XML attachment
securitySecurity: Better fix for CVE-2020-12641
1.4.4 Apr 29, 2020 Release notes ↗
securityCross-Site Scripting (XSS) via malicious HTML content
securityCSRF attack can cause an authenticated user to be logged out
securityRemote code execution via crafted config options
securityPath traversal vulnerability allowing local file inclusion via crafted 'plugins' option
fixFix bug where attachments with Content-Id were attached to the message on reply (#7122)
fixFix identity selection on reply when both sender and recipient addresses are included in identities (#7211)
fixElastic: Fix text selection with Shift+PageUp and Shift+PageDown in plain text editor when using Chrome (#7230)
fixElastic: Fix recipient input bug when using click to select a contact from autocomplete list (#7231)
fixElastic: Fix color of a folder with recent messages (#7281)
otherElastic: Restrict logo size in print view (#7275)
fixFix invalid Content-Type for messages with only html part and inline images - Mail_Mime-1.10.7 (#7261)
fixFix missing contact display name in QR Code data (#7257)
fixFix so button label in Select image/media dialogs is "Close" not "Cancel" (#7246)
fixFix regression in testing database schema on MSSQL (#7227)
fixFix cursor position after inserting a group to a recipient input using autocompletion (#7267)
fixFix string literals handling in IMAP STATUS (and various other) responses (#7290)
fixFix bug where multiple images in a message were replaced by the first one on forward/reply/edit (#7293)
fixFix handling keyservers configured with protocol prefix (#7295)
fixMarkasjunk: Fix marking as spam/ham on moving messages with Move menu (#7189)
fixMarkasjunk: Fix bug where moving to Junk was failing on messages selected with Select > All (#7206)
fixFix so imap error message is displayed to the user on folder create/update (#7245)
fixFix bug where a special folder couldn't be created if a special-use flag is not supported (#7147)
fixMailvelope: Fix bug where recipients with name were not handled properly in mail compose (#7312)
fixFix characters encoding in group rename input after group creation/rename (#7330)
fixFix bug where some message/rfc822 parts could not be attached on forward (#7323)
otherMake install-jsdeps.sh script working without the file program installed (#7325)
fixFix performance issue of parsing big HTML messages by disabling HTML5 parser for these (#7331)
fixFix so Print button for PDF attachments works on Firefox >= 75 (#5125)
securitySecurity: Fix XSS issue in handling of CDATA in HTML messages
securitySecurity: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings
securitySecurity: Fix local file inclusion (and code execution) via crafted 'plugins' option
securitySecurity: Fix CSRF bypass that could be used to log out an authenticated user (#7302)
1.4.3 Feb 19, 2020 Release notes ↗
fixEnigma: Fix so key list selection is reset when opening key creation form (#7154)
fixEnigma: Fix so using list checkbox selection does not load the key preview frame
fixEnigma: Fix generation of key pairs for identities with IDN domains (#7181)
otherEnigma: Display IDN domains of key users and identities in UTF8
fixEnigma: Fix bug where "Send unencrypted" button didn't work in Elastic skin (#7205)
fixManagesieve: Fix bug where it wasn't possible to save flag actions (#7188)
fixMarkasjunk: Fix bug where marking as spam/ham didn't work on moving messages with drag-and-drop (#7137)
otherPassword: Make chpass-wrapper.py Python 3 compatible (#7135)
fixElastic: Fix disappearing sidebar in mail compose after clicking Mail button
fixElastic: Fix incorrect aria-disabled attribute on Mail taskmenu button in mail compose
fixElastic: Fix bug where it was possible to switch editor mode when 'htmleditor' was in 'dont_override' (#7143)
fixElastic: Fix text selection in recipient inputs (#7129)
fixElastic: Fix missing Close button in "more recipients" dialog
fixElastic: Fix non-working folder subscription checkbox for newly added folders (#7174)
fixFix regression where "Open in new window" action didn't work (#7155)
fixFix PHP Warning: array_filter() expects parameter 1 to be array, null given in subscriptions_option plugin (#7165)
fixFix unexpected error message when mail refresh involves folder auto-unsubscribe (#6923)
fixFix recipient duplicates in print-view when the recipient list has been expanded (#7169)
fixFix bug where files in skins/ directory were listed on skins list (#7180)
fixFix bug where message parts with no Content-Disposition header and no name were not listed on attachments list (#7117)
fixFix display issues with mail subject that contains line-breaks (#7191)
fixFix invalid Content-Transfer-Encoding on multipart messages - Mail_Mime fix (#7170)
fixFix regression where using an absolute path to SQLite database file on Windows didn't work (#7196)
fixFix using unix:///path/to/socket.file in memcached driver (#7210)
1.4.2 Jan 1, 2020 Release notes ↗
otherPlugin API: Make actionbefore, before, actionafter and after events working with plugin actions (#7106)
otherManagesieve: Replace "Filter disabled" with "Filter enabled" (#7028)
fixManagesieve: Fix so modifier type select wasn't hidden after hiding modifier select on header change
fixManagesieve: Fix filter selection after removing a first filter (#7079)
fixMarkasjunk: Fix marking more than one message as spam/ham with email_learn driver (#7121)
fixPassword: Fix kpasswd and smb drivers' double-escaping bug (#7092)
featureEnigma: Add script to import keys from filesystem to the db storage (for multihost)
fixInstaller: Fix DB Write test on SQLite database ("database is locked" error) (#7064)
fixInstaller: Fix so SQLite DSN with a relative path to the database file works in Installer
fixElastic: Fix contrast of warning toasts (#7058)
otherElastic: Simple search in pretty selects (#7072)
fixElastic: Fix hidden list widget on mobile/tablet when selecting folder while search menu is open (#7120)
fixFix so type attribute on script tags is not used on HTML5 pages (#6975)
fixFix unread count after purge on a folder that is not currently selected (#7051)
fixFix bug where Enter key didn't work on messages list in "List" layout (#7052)
fixFix bug where deleting a saved search in addressbook caused display issue on sources/groups list (#7061)
fixFix bug where a new saved search added after removing all searches wasn't added to the list (#7061)
fixFix bug where a new contact group added after removing all groups from addressbook wasn't added to the list
fixFix bug where Ctype extension wasn't required in Installer and INSTALL file (#7049)
fixFix so install-jsdeps.sh removes Bootstrap's sourceMappingURL (#7035)
fixFix so use of Ctrl+A does not scroll the list (#7020)
fixFix/remove useless keyup event handler on username input in logon form (#6970)
fixFix bug where cancelling switching from HTML to plain text didn't set the flag properly (#7077)
fixFix bug where HTML reply could add an empty line with extra indentation above the original message (#7088)
fixFix matching multiple X-Forwarded-For addresses with 'proxy_whitelist' (#7107)
fixFix so displayed maximum attachment size depends also on 'max_message_size' (#7105)
fixFix bug where 'skins_allowed' option didn't enforce user skin preference (#7080)
fixFix so contact's organization field accepts up to 128 characters (it was 50)
fixFix bug where listing tables in PostgreSQL database with db_prefix didn't work (#7093)
fixFix bug where 'text' attribute on body tag was ignored when displaying HTML message (#7109)
fixFix bug where next message wasn't displayed after delete in List mode (#7096)
fixFix so number of contacts in a group is not limited to 200 when redirecting to mail composer from Contacts (#6972)
fixFix malformed characters in HTML message with charset meta tag not in head (#7116)
1.4.1 Nov 22, 2019 Release notes ↗
breaking### new defaults for smtp_* config options: Upon many requests and in order to get closer to the default setup of most SMTP servers, we changed the defaults as follows: // SMTP port (default is 587) $config['smtp_port'] = 587; // SMTP username (if required). %u will use the current username for…
breaking### changed default password_charset to UTF-8: Because of many complaints, we decided to choose a more sane default that covers most setups and configurations.
breaking### login page returning 401 Unauthorized status: The new behavior that Roundcube 1.4 returns a 401 status code if the client is not authenticated apparently was very unexpected and lead to monitoring problems. Despite not having mentioned that change in the release notes, we now partly reverted…
otherElastic: Change HTML editor widget to improve form flow (#6992)
fixElastic: Fix position of mobile floating action button (#7038)
fixManagesieve: Fix locked UI after opening filter frame (#7007)
fixFix PHP warning: "array_merge(): Expected parameter 2 to be an array, null given in sendmail.inc (#7003)
fixFix bug where cache keys could exceed length limit specified in db schema (#7004)
fixFix invalid Signature button state after escaping Mailvelope mode (#7015)
fixFix so 401 error is returned only on failed logon requests (#7010)
fixFix db_prefix handling in queries with TRUNCATE TABLE and UNIQUE (#7013)
fixFix so update.sh script warns about changed defaults (#7011)
fixFix tables listing routine when DSN contained a database with unsupported suffix (#7034)
fixFix so Elastic is also a default in jqueryui plugin (#7039)
fixFix bug where the Installer would not warn about required schema upgrade (#7042)
1.4.0 Nov 9, 2019 Release notes ↗
otherEmail Resent (Bounce) feature
otherImproved Mailvelope integration
featureSupport for Redis and Memcached cache
featureSupport for SMTPUTF8 and GSSAPI
otherElastic: Resizeable columns (#6929)
fixElastic: Fix position and style of auto-complete dropdown on small screens (#6951)
fixElastic: Fix initial focus on recipients input in mail compose screen
fixElastic: Fix inserting responses at cursor position (#6971)
fixElastic: Fix unread filter icon and search state on folder change (#6978)
fixElastic: Fix regression where Encrypt button wasn't displayed in mail compose toolbar (#6982)
fixElastic: Fix regression where recipient input didn't update internal input state (#6988)
fixEnigma: Fix bug where signing option was set to disabled after saving a draft in Elastic skin (#6515)
otherRedis: Improve error handling and phpredis 5.X support (#6888)
fixArchive: Fix bug where next email was not displayed after Archive button use (#6965)
fixArchive: Fix missing Archive icon in folder selector popup in Elastic
fixFix bug where cache keys were not case-sensitive on MySQL/MSSQL (#6942)
fixFix so an error is logged when encryption fails (#6948)
fixFix bug where inline images could have been ignored if Content-Id header contained redundant spaces (#6980)
fixFix and document skin_logo setup (#6981)
See how far your stack has drifted from upstream. Release data from vendors’ own sources · feed under CC BY 4.0 · Code under AGPL-3.0 Settings Feed status