Dev May 2026

dev@lists.roundcube.net

3 participants
3 discussions

Security updates 1.7.1 and 1.6.16 released
by Aleksander Machniak 24 May '26

24 May '26

Here's the same message with corrected subject. Sorry about that. We just published security updates to the 1.7 and 1.6 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. Security fixes: - Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy - Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">`, reported by wooseokdotkim - Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull - Fix SSRF bypass via specific local address URLs - Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team - Fix bypass of remote image blocking via CSS var(), reported by Geame - Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1 - Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option, reported by Glendaenri See the full changelogs in the release notes on the Github download pages for the updated versions 1.7.1 and 1.6.16. https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions. -- Alec

1 0

Security updates 1.5.13 and 1.6.13 released
by Aleksander Machniak 24 May '26

24 May '26

We just published security updates to the 1.7 and 1.6 LTS versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities. Security fixes: - Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy - Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">`, reported by wooseokdotkim - Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull - Fix SSRF bypass via specific local address URLs - Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team - Fix bypass of remote image blocking via CSS var(), reported by Geame - Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1 - Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option, reported by Glendaenri See the full changelogs in the release notes on the Github download pages for the updated versions 1.7.1 and 1.6.16. https://github.com/roundcube/roundcubemail/releases/tag/1.7.1 https://github.com/roundcube/roundcubemail/releases/tag/1.6.16 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions. -- Alec

1 0

Roundcube Webmail 1.7.0 released
by Aleksander Machniak 11 May '26

11 May '26

This is the stable release of the next major version 1.7 of Roundcube Webmail. After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality. Some noteworthy changes are: - Mandatory `public_html/` entry-point for HTTP servers, protecting all installations better. - Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout). - Markdown mail rendering and composing. - A quick actions mouse-over menu on the messages list. - Advanced mail search syntax. ## Breaking Changes - Dropped support for PHP < 8.1. - Dropped support for Internet Explorer. - Dropped support for MS SQL Server and Oracle. - `public_html/` entry-point made mandatory, all static resources are served via `public_html/static.php`. - Removed `apc` cache driver (replaced by `apcu` cache driver). - Changed `smtp_log` option default value to `false`. - Removed `contact_search_name` option in favor of `contactlist_name_template`. - Replaced session property `changed` by `expires_at`. - Removed the (insecure) virtualmin password driver. This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained. And don't forget to backup your data before installing it! You can download it from https://roundcube.net Cheers, Alec

3 3

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Dev May 2026