Roundcube 1.7.4 → 1.7.6

Vulnerabilities fixed by this upgrade

• 5.3 CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, b…
• 7.2 CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6…
• 5.3 CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read…
• 6.8 CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::qu…
• 6.5 CVE-2026-114722 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a s…
• 3.7 CVE-2026-114723 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory che…
• 7.4 CVE-2026-114724 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and th…
• 5.0 CVE-2026-114725 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization heade…
• 5.8 CVE-2026-114726 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control ch…
• 8.3 CVE-2026-114727 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo uplo…
• 5.3 CVE-2026-114728 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a patte…
• 8.5 CVE-2026-114716 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image…
• 4.0 CVE-2026-114717 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was us…
• 4.7 CVE-2026-114718 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the…
• 3.7 CVE-2026-114719 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data…
• 7.1 CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the…
• 3.1 CVE-2026-114721 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authentica…
• 6.8 CVE-2026-114715 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the a…

Breaking changes

None in the release notes.

Security changes

• security Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd. in 1.7.6
• security Fix CSRF validation bypass for file-only POST requests, reported by skad00sh. in 1.7.6
• security Fix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky. in 1.7.6
• security Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765. in 1.7.6
• security Security: Fix open redirect via IMAP error recovery on attachment get in 1.7.6
• security Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy in 1.7.6
• security Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET in 1.7.6
• security Security: Fix Sieve script injection via a rule operator in 1.7.6
• security Security: Fix Sieve script injection via set/include modifiers in 1.7.6
• security Security: Fix bug where resolve_url() ignored trusted host setting in 1.7.6
• security Security: Fix mail header injection via a MDN subject in 1.7.6
• security Security: Fix HTTP request injection via the spellcheck ATD backend in 1.7.6
• security Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled in 1.7.6
• security Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass in 1.7.6
• security Security: Fix CSRF validation bypass for file-only POST requests in 1.7.6
• security Security: Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name in 1.7.6
• security Security: Fix CSRF validation bypass for mail purge/expunge commands in 1.7.6
• security Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion in 1.7.6
• security Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token in 1.7.6
• security Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses in 1.7.6
• security Security: Fix so IMAP host input is validated more strictly in 1.7.6
• security Fixes CVE-2026-114716: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image… in 1.7.5
• security Fixes CVE-2026-114727: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing images. SVG and EPS were accepted as valid image types for contact photo uplo… in 1.7.5
• security Fixes CVE-2026-114724: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and th… in 1.7.5
• security Fixes CVE-2026-114730: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass. The network blocklist used by rcube_utils::is_local_url() omitted the RFC 6… in 1.7.5
• security Fixes CVE-2026-114720: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the… in 1.7.5
• security Fixes CVE-2026-114732: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in multi-host installations. When a user logs in with an alias address, rcube_user::qu… in 1.7.5
• security Fixes CVE-2026-114715: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the Modoboa driver of the password plugin. The driver took the first entry of the a… in 1.7.5
• security Fixes CVE-2026-114722: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages. rcube_utils::mod_css_styles() did not treat an at-rule prologue such as @layer a; as a s… in 1.7.5
• security Fixes CVE-2026-114726: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control ch… in 1.7.5
• security Fixes CVE-2026-114729: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass. rcube_washtml inspected the SVG SMIL animation attributes `to`, `from` and values for URIs, b… in 1.7.5
• security Fixes CVE-2026-114731: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action). The fetched stylesheet was read… in 1.7.5
• security Fixes CVE-2026-114728: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling of FuncIRI attributes. rcube_washtml detected the CSS url() token with a patte… in 1.7.5
• security Fixes CVE-2026-114725: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization heade… in 1.7.5
• security Fixes CVE-2026-114718: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the password plugin. Error text returned by a password driver was concatenated into the… in 1.7.5
• security Fixes CVE-2026-114717: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was us… in 1.7.5
• security Fixes CVE-2026-114723: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during thumbnail generation. When rcube_image falls back to GD, the available-memory che… in 1.7.5
• security Fixes CVE-2026-114719: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk action of the markasjunk plugin. The plugin read the _uid parameter from POST data… in 1.7.5
• security Fixes CVE-2026-114721: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed. The check compared only the action name as requested, so a remote authentica… in 1.7.5
• security Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect. in 1.7.5
• security Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5
• security Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5
• security Security: Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action in 1.7.5
• security Security: Fix bug where an alias login wasn't qualified by IMAP host in 1.7.5
• security Security: Add a size limit to the CSS proxy content processing in 1.7.5
• security Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96 in 1.7.5
• security Security: Fix remote content blocking bypass via SVG SMIL by attribute in 1.7.5
• security Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again) in 1.7.5
• security Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize in 1.7.5
• security Security: Fix mail header injection via the From display-name in the Bounce (resend) action in 1.7.5
• security Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters in 1.7.5
• security Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys in 1.7.5
• security Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation in 1.7.5
• security Security: Fix CSS scoping bypass in HTML messages using at-rules in 1.7.5
• security Security: Fix bug where deprecated action aliases bypassed disabled_actions setting in 1.7.5
• security Security: Fix IMAP command injection via CRLF in _flag parameter of mail/mark action in 1.7.5
• security Security: Fix CSRF validation bypass in the mark-as-junk action in 1.7.5
• security Security: Fix XSS issue in handling of password driver error responses in 1.7.5
• security Security: Fix mail header injection via subject of a message forwarded as attachment in 1.7.5
• security Security: Fix mail header injection via media type in an inline image data URI in 1.7.5
• security Security: Fix bug where Password Modoboa driver could change password for another account in 1.7.5
• security Security: Fix unsafe use of a login name in SquirrelMail import file path in 1.7.5

Deprecations

• deprecated Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. in 1.7.5

Every release in between