Users

users@lists.roundcube.net

6 participants
2968 discussions

Roundcube Webmail 1.7.0 released
by Aleksander Machniak 11 May '26

11 May '26

This is the stable release of the next major version 1.7 of Roundcube Webmail. After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality. Some noteworthy changes are: - Mandatory `public_html/` entry-point for HTTP servers, protecting all installations better. - Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout). - Markdown mail rendering and composing. - A quick actions mouse-over menu on the messages list. - Advanced mail search syntax. ## Breaking Changes - Dropped support for PHP < 8.1. - Dropped support for Internet Explorer. - Dropped support for MS SQL Server and Oracle. - `public_html/` entry-point made mandatory, all static resources are served via `public_html/static.php`. - Removed `apc` cache driver (replaced by `apcu` cache driver). - Changed `smtp_log` option default value to `false`. - Removed `contact_search_name` option in favor of `contactlist_name_template`. - Replaced session property `changed` by `expires_at`. - Removed the (insecure) virtualmin password driver. This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained. And don't forget to backup your data before installing it! You can download it from https://roundcube.net Cheers, Alec

2 1

Hacking attempt or real message?
by SHAN GORDON 02 May '26

02 May '26

Hi, I have an email through Inmotion Hosting and I received the message below. Is this a hacking attempt or a legitimate upgrade? I would have expected an upgrade to come through the Inmotion hosting site and to be posted far ahead of the transition period. Please advise. Best wishes, Shan Gordon shan(a)mdenergysavers.com

4 3

Fwd: Error en ciertos correos en Roundcube
by Gerardo Contreras 31 Mar '26

31 Mar '26

Hello all, Today I upgraded from roundcube 1.6.13 to 1.6.15 because of the security concerns. I am installing on a test page, This happened to me upgrading to 1.6.14 as well, but I thought there was an actual problem with malformed emails or broken DB, or something like that. In the test version, I tried to go into certain emails that gave me a problem in 1.6.14, The error is the following (on the message frame) But in production, I get the following: So, in production, I give it permission to show remote resources After that, I go to 1.6.15 and it shows the message without problems: So the error doesn't seem to come from a malformed message or from a DB problem, It seems that 1.6.14 and 15 err out on showing this prompt: I would like your help in figuring out if it's a coding problem, or if I am missing a php module or something like that that 1.6.13 and earlier did not require. Not related, but migth give a clue, I do have a composer error when upgrading: ***************************************************************************** NOTICE: New .htaccess file saved as .htaccess.new. Running update script at target... Executing database schema update. /bin/composer Executing /bin/composer to update dependencies... Composer could not detect the root package (roundcube/roundcubemail) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires phpunit/phpunit ^4.8.36 || ^5.7.21, found phpunit/phpunit[4.8.36, 5.7.21, ..., 5.7.27] but these were not loaded, because they are affected by security advisories ("PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems. ----------------------------------------------------------------------------- ATTENTION: Update dependencies by running `php composer.phar update --no-dev` ----------------------------------------------------------------------------- This instance of Roundcube is up-to-date. Have fun! All done. ********************************************************************* Composer.phar is not found on the installer directory or the test directory, and when installing 1.6.14 I did "composer install" on the test directory and told me that one of the plugins: rc_login_background, could not be processed, because it was written for 1.3.9 or later and I have 1.6.14. Any further config info I might provide I'll be happy to. Thanks.

1 1

[RCD] Security updates 1.6.15 and 1.5.15 (and 1.7-rc6) released
by Aleksander Machniak 29 Mar '26

29 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability. ## Security fixes - SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc6 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.15 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.15 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

[RCD] Security updates 1.6.14 and 1.5.14 (and 1.7-rc5) released
by Aleksander Machniak 18 Mar '26

18 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. They contain fixes for recently reported set of security vulnerabilities. ## Security fixes - Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. - Fix bug where a password could get changed without providing the old password, reported by flydragon777. - Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. - Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral. - Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral. - Fix fixed position mitigation bypass via use of !important, reported by nullcathedral. - Fix XSS issue in a HTML attachment preview, reported by aikido_security. - Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

add alt+s to send the email?
by Marc 10 Mar '26

10 Mar '26

Maybe good to standard support alt+s to send the email (outlook) and maybe also add whatever apple mail key combination uses.

3 2

slow with sso
by Marc 08 Mar '26

08 Mar '26

I am testing a bit with single sign on, but I have the impression the whole interface is quite a bit slower than not using this single sign on. Using dovecot 2.3 still with keycloak. Anyone having the same experience, maybe I did not configure this optimal?

1 0

Roundcube webmail 1.7 RC4 released
by Pablo Zimdahl 25 Feb '26

25 Feb '26

We just published the fourth release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two minor issues, it's mostly published to fix a file permission problem in the previous release v1.7-rc3. The changes are: - Ensure correct file permissions when building a release. - Installer: Fix broken link to download the created configuration file (#10092) The tarballs can be downloaded [from roundcube.net/download](https://roundcube.net/download/). Or directly from [the release page at github.com](https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc4). We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

2 1

INBOX shows 'No messages found' but messages exist in Email Disk Usage
by Nikolas Adi 17 Feb '26

17 Feb '26

Dear Roundcube Support Team, I am experiencing an issue with one of our email accounts hosted on cPanel (Niagahoster). Email account: *pajak.stp(a)tstjateng.co.id* <pajak.stp(a)tstjateng.co.id> Problem description: - In Roundcube Webmail, the INBOX displays the message: *"No messages found"*. - However, in cPanel → Email Disk Usage, it shows that there are *49 messages in the INBOX*. - Email storage is not full (396.91 MB used out of 1 GB). - There are no active email filters. - The INBOX folder is subscribed (default and cannot be disabled). This indicates that the messages physically exist on the server, but Roundcube is unable to display them. Could this be related to: - IMAP index corruption? - Dovecot index/cache issue? - Roundcube cache problem? Please advise on the recommended steps to resolve this issue. Thank you for your assistance. Best regards, Niko

4 4

Roundcube webmail 1.7 RC3 released
by Pablo Zimdahl 10 Feb '26

10 Feb '26

We just published the third release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two security issues, and contains a few more fixes for several issues. The security fixes are: - Fix CSS injection vulnerability reported by CERT Polska. - Fix remote image blocking bypass via SVG content reported by nullcathedral. For the full changelog please see the release page: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3. The tarballs can be downloaded via roundcube.net: https://roundcube.net/download/ Or directly from the release page at github.com: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3 We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users