Roundcube 1.6.17 → 1.6.18

1 release · 0 breaking changes · 15 security fixes · 0 advisories fixed

15security0breaking0deprecated1feature8fix

Is 1.6.17 affected? · What changed up to 1.7.5

Breaking changes

None in the release notes.

Security changes

security Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko in 1.6.18
security Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe in 1.6.18
security Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337 in 1.6.18
security Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai in 1.6.18
security Security: Add basic validation for content proxied by the css proxy in 1.6.18
security Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets in 1.6.18
security Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check in 1.6.18
security Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute in 1.6.18
security Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter in 1.6.18
security Security: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions in 1.6.18
security Security: Fix RCE via cmd_learn driver of markasjunk plugin in 1.6.18
security Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization in 1.6.18
security Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host in 1.6.18
security Security: Fix stored XSS in "Add to address book" action in 1.6.18
security Security: Fix HTML/CSS sanitization bypass via SVG animate by attribute in 1.6.18

Every release in between

1.6.18 Aug 9, 2026 Release notes ↗

featureAdd basic validation for content proxied by the css proxy

securityFix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko

securityFix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe

fixFix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe

fixFix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter, reported by Milan Hoppe

fixFix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions, reported by Milan Hoppe

securityFix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337

fixFix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai

fixFix password's modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun

securityFix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai

fixFix HTML/CSS sanitization bypass via SVG animate by attribute, reported by vectrain

fixPassword: Fix fatal error "Class 'Zxcvbn' not found" (#10274)

fixFix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)

securitySecurity: Add basic validation for content proxied by the css proxy

securitySecurity: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets

securitySecurity: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check

securitySecurity: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute

securitySecurity: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter

securitySecurity: Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions

securitySecurity: Fix RCE via cmd_learn driver of markasjunk plugin

securitySecurity: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization

securitySecurity: Fix password's modoboa driver leak of an authentication token to a user-controlled host

securitySecurity: Fix stored XSS in "Add to address book" action

securitySecurity: Fix HTML/CSS sanitization bypass via SVG animate by attribute