Roundcube 1.6.10 → 1.6.18

Breaking changes

• breaking Remove mobile/floating Create button from the list in Settings > Folders (#9661) in 1.6.11

Security changes

• security Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko in 1.6.18
• security Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe in 1.6.18
• security Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 in 1.6.18
• security Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai in 1.6.18
• security Security: Add basic validation for content proxied by the css proxy in 1.6.18
• security Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets in 1.6.18
• security Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check in 1.6.18
• security Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute in 1.6.18
• security Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter in 1.6.18
• security Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions in 1.6.18
• security Security: Fix RCE via cmd_learn driver of markasjunk plugin in 1.6.18
• security Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization in 1.6.18
• security Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host in 1.6.18
• security Security: Fix stored XSS in "Add to address book" action in 1.6.18
• security Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute in 1.6.18
• security Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost. in 1.6.17
• security Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit in 1.6.17
• security Fix SSRF bypass via specific local address URLs - two new cases, reported by Leenear. in 1.6.17
• security Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433], reported by Bohdan Kurinnoy, Samsung R&D Institute Ukraine (SRUKR). in 1.6.17
• security Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) in 1.6.17
• security Security: Fix various vulnerabilities in the password plugin using session-injected username in 1.6.17
• security Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432] in 1.6.17
• security Security: Fix SSRF bypass via specific local address URLs - two new cases in 1.6.17
• security Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433] in 1.6.17
• security Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file in 1.6.17
• security Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by Anand Jogawade (zazy) in 1.6.16
• security Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull in 1.6.16
• security Fix SSRF bypass via specific local address URLs in 1.6.16
• security Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team in 1.6.16
• security Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri in 1.6.16
• security Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog in 1.6.16
• security Security: Fix CSS injection bypass in HTML sanitizer via SVG in 1.6.16
• security Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass in 1.6.16
• security Security: Fix SSRF bypass via specific local address URLs in 1.6.16
• security Security: Fix bypass of remote image blocking via CSS var() in 1.6.16
• security Security: Fix local/private URL fetch bypass when remote resources were not allowed in 1.6.16
• security Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass in 1.6.16
• security Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option in 1.6.16
• security Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. in 1.6.14
• security Fix XSS issue in a HTML attachment preview, reported by aikido_security. in 1.6.14
• security Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. in 1.6.14
• security Security: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler in 1.6.14
• security Security: Fix bug where a password could get changed without providing the old password in 1.6.14
• security Security: Fix IMAP Injection + CSRF bypass in mail search in 1.6.14
• security Security: Fix remote image blocking bypass via various SVG animate attributes in 1.6.14
• security Security: Fix remote image blocking bypass via a crafted body background attribute in 1.6.14
• security Security: Fix fixed position mitigation bypass via use of !important in 1.6.14
• security Security: Fix XSS issue in a HTML attachment preview in 1.6.14
• security Security: Fix SSRF + Information Disclosure via stylesheet links to a local network hosts in 1.6.14
• security Fix CSS injection vulnerability reported by CERT Polska. in 1.6.13
• security Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. in 1.6.12
• security Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. in 1.6.12
• security Remove X-XSS-Protection example from .htaccess file (#9875) in 1.6.12
• security Fix Cross-Site-Scripting vulnerability via SVG's animate tag in 1.6.12
• security Fix Information Disclosure vulnerability in the HTML style sanitizer in 1.6.12
• security Fix Post-Auth RCE via PHP Object Deserialization reported by firs0v. in 1.6.11

Every release in between