- Users - Roundcube mailing lists

Fwd: Error en ciertos correos en Roundcube
by Gerardo Contreras 31 Mar '26

31 Mar '26

Hello all, Today I upgraded from roundcube 1.6.13 to 1.6.15 because of the security concerns. I am installing on a test page, This happened to me upgrading to 1.6.14 as well, but I thought there was an actual problem with malformed emails or broken DB, or something like that. In the test version, I tried to go into certain emails that gave me a problem in 1.6.14, The error is the following (on the message frame) But in production, I get the following: So, in production, I give it permission to show remote resources After that, I go to 1.6.15 and it shows the message without problems: So the error doesn't seem to come from a malformed message or from a DB problem, It seems that 1.6.14 and 15 err out on showing this prompt: I would like your help in figuring out if it's a coding problem, or if I am missing a php module or something like that that 1.6.13 and earlier did not require. Not related, but migth give a clue, I do have a composer error when upgrading: ***************************************************************************** NOTICE: New .htaccess file saved as .htaccess.new. Running update script at target... Executing database schema update. /bin/composer Executing /bin/composer to update dependencies... Composer could not detect the root package (roundcube/roundcubemail) version, defaulting to '1.0.0'. See https://getcomposer.org/root-version Loading composer repositories with package information Updating dependencies Your requirements could not be resolved to an installable set of packages. Problem 1 - Root composer.json requires phpunit/phpunit ^4.8.36 || ^5.7.21, found phpunit/phpunit[4.8.36, 5.7.21, ..., 5.7.27] but these were not loaded, because they are affected by security advisories ("PKSA-z3gr-8qht-p93v"). Go to https://packagist.org/security-advisories/ to find advisory details. To ignore the advisories, add them to the audit "ignore" config. To turn the feature off entirely, you can set "block-insecure" to false in your "audit" config. Running update with --no-dev does not mean require-dev is ignored, it just means the packages will not be installed. If dev requirements are blocking the update you have to resolve those problems. ----------------------------------------------------------------------------- ATTENTION: Update dependencies by running `php composer.phar update --no-dev` ----------------------------------------------------------------------------- This instance of Roundcube is up-to-date. Have fun! All done. ********************************************************************* Composer.phar is not found on the installer directory or the test directory, and when installing 1.6.14 I did "composer install" on the test directory and told me that one of the plugins: rc_login_background, could not be processed, because it was written for 1.3.9 or later and I have 1.6.14. Any further config info I might provide I'll be happy to. Thanks.

1 1

[RCD] Security updates 1.6.15 and 1.5.15 (and 1.7-rc6) released
by Aleksander Machniak 29 Mar '26

29 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. It provides fixes to some regressions introduced in the previous release as well a recently reported security vulnerability. ## Security fixes - SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc6 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.15 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.15 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

[RCD] Security updates 1.6.14 and 1.5.14 (and 1.7-rc5) released
by Aleksander Machniak 18 Mar '26

18 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. They contain fixes for recently reported set of security vulnerabilities. ## Security fixes - Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. - Fix bug where a password could get changed without providing the old password, reported by flydragon777. - Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. - Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral. - Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral. - Fix fixed position mitigation bypass via use of !important, reported by nullcathedral. - Fix XSS issue in a HTML attachment preview, reported by aikido_security. - Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

add alt+s to send the email?
by Marc 10 Mar '26

10 Mar '26

Maybe good to standard support alt+s to send the email (outlook) and maybe also add whatever apple mail key combination uses.

3 2

slow with sso
by Marc 08 Mar '26

08 Mar '26

I am testing a bit with single sign on, but I have the impression the whole interface is quite a bit slower than not using this single sign on. Using dovecot 2.3 still with keycloak. Anyone having the same experience, maybe I did not configure this optimal?

1 0

Roundcube webmail 1.7 RC4 released
by Pablo Zimdahl 25 Feb '26

25 Feb '26

We just published the fourth release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two minor issues, it's mostly published to fix a file permission problem in the previous release v1.7-rc3. The changes are: - Ensure correct file permissions when building a release. - Installer: Fix broken link to download the created configuration file (#10092) The tarballs can be downloaded [from roundcube.net/download](https://roundcube.net/download/). Or directly from [the release page at github.com](https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc4). We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

2 1

INBOX shows 'No messages found' but messages exist in Email Disk Usage
by Nikolas Adi 17 Feb '26

17 Feb '26

Dear Roundcube Support Team, I am experiencing an issue with one of our email accounts hosted on cPanel (Niagahoster). Email account: *pajak.stp(a)tstjateng.co.id* <pajak.stp(a)tstjateng.co.id> Problem description: - In Roundcube Webmail, the INBOX displays the message: *"No messages found"*. - However, in cPanel → Email Disk Usage, it shows that there are *49 messages in the INBOX*. - Email storage is not full (396.91 MB used out of 1 GB). - There are no active email filters. - The INBOX folder is subscribed (default and cannot be disabled). This indicates that the messages physically exist on the server, but Roundcube is unable to display them. Could this be related to: - IMAP index corruption? - Dovecot index/cache issue? - Roundcube cache problem? Please advise on the recommended steps to resolve this issue. Thank you for your assistance. Best regards, Niko

4 4

Roundcube webmail 1.7 RC3 released
by Pablo Zimdahl 10 Feb '26

10 Feb '26

We just published the third release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two security issues, and contains a few more fixes for several issues. The security fixes are: - Fix CSS injection vulnerability reported by CERT Polska. - Fix remote image blocking bypass via SVG content reported by nullcathedral. For the full changelog please see the release page: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3. The tarballs can be downloaded via roundcube.net: https://roundcube.net/download/ Or directly from the release page at github.com: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3 We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

1 0

Security updates 1.5.13 and 1.6.13 released
by Aleksander Machniak 08 Feb '26

08 Feb '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities. Security fixes: - Fix CSS injection vulnerability reported by CERT Polska. - Fix remote image blocking bypass via SVG content reported by nullcathedral. See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.13 and 1.5.13. https://github.com/roundcube/roundcubemail/releases/tag/1.6.13 https://github.com/roundcube/roundcubemail/releases/tag/1.5.13 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions. -- Alec

1 0

Roundcube in a rootless podman container
by Thing 29 Jan '26

29 Jan '26

Hi, I want to upgrade my roundcube setup and I am thinking of using a container this time. Has anyone done so and know of good docs for rootless podman? mysql would stay as a VM. regards Steven

2 1

Roundcube 1.7 RC released
by Pablo Zimdahl 28 Jan '26

28 Jan '26

The development team is pleased to announce the release candidate for the next major version 1.7 of Roundcube webmail! With this milestone we introduce a few breaking changes (see below) and some further improvements in comparison to 1.7-beta2. Some noteworthy changes are: * Add scope parameter to contact search (#9863) * Add ability to chose from all available contact fields on CSV import (#9419) * Add a new plugin called `markdown_editor` that provides an alternative editor to compose emails using Markdown syntax. * Add `rel=’noopener’` to all links opening in a new window to mitigate against misuse in older browsers. Breaking Changes: * Remove `contact_search_name` option in favor of `contactlist_name_template` (#9832) * Replace session attribute `changed` by `expires_at` (to allow for variable session lengths per-user in a future change). * Password: Removed the (insecure) `virtualmin` driver (#8007) For full details and download links please read the release notes: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don’t forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

2 1

Is there a logfile for enduser activity in Roundcube?
by Graham Spillman 27 Jan '26

27 Jan '26

My Welcome email suggests I use email to submit a new posting I am, of course, a newbie to this forum I wish to post this as a new thread. I have searched widely for RoundCube related issues There are very few. One or two similar in 2008, long ago fixed This is a last ditch request for knowledge of any diagnostic log files that might exist when a user connects to his RoundCube webmail server Graham Spillman ============== Our local vicar uses Roundcube 1.6.12 to circulate the parish newsletter to church members The contents are technically very ordinary - plain text body plus a number of attachments, mainly PDFs, or possibly MS Word He emails himself weekly, with Blind copies to his 250+ parishioners What could go wrong? ANSWER: the ATTACHMENTS GO MISSING, on arrival into all Inboxes His Inbox lists the email with the paperclip attachment symbol, but on opening the mail, there are no attachments. I have seen a screenshot myself This has happened two or three times in recent weeks I'm pretty sure there have been no changes to his PC in AGES. QUESTION Does RoundCube record any log of client user actions at the browser end?? Is there any record anywhere of what the user actually did when intended attachments have gone AWOL? spilly80

2 2

remove .domain from username login
by dalemango13＠gmail.com 13 Jan '26

13 Jan '26

Ive been trying to change the username.domain to just username and/or username(a)domain.tdl but I do not know how I would go about doing that. Anyone have an answer?

3 2

Roundcube webmail 1.7 RC2 released
by Pablo Zimdahl 15 Dec '25

15 Dec '25

We just published the second release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two security issues and one syntax error in a database migration file for Postgres databases. The changes are: - Fix Cross-Site-Scripting vulnerability via SVG’s animate tag reported by Valentin T., CrowdStrike. - Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. - Fix syntax error in DDL scripts for Postgres (#10052) The tarballs can be downloaded from github.com or roundcube.net: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc2 https://roundcube.net/download/ We believe it is production ready, but we recommend to test it on a separate environment. Existing setups can be migrated with either the `installto.sh` or the `update.sh` scripts. Please don't forget to backup your data before updating! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

1 0

Security updates 1.5.12 and 1.6.12 released
by Aleksander Machniak 14 Dec '25

14 Dec '25

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities. Security fixes: - Fix Cross-Site-Scripting vulnerability via SVG's animate tag reported by Valentin T., CrowdStrike. - Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev. See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.12 and 1.5.12. https://github.com/roundcube/roundcubemail/releases/tag/1.6.12 https://github.com/roundcube/roundcubemail/releases/tag/1.5.12 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions. -- Alec

1 0

Seeking DNS Configuration Guidance for Roundcube Webmail on HestiaCP
by neo＠myheat.co.za 06 Dec '25

06 Dec '25

Hello everyone, I've recently installed Roundcube webmail on a VPS server running HestiaCP and I'm in the process of configuring the DNS records for one of my domains. I'm seeking your guidance to ensure my DNS configuration properly supports Roundcube. I've configured DNS records for my domain through my hosting provider. The configuration includes: A Records: Root domain pointing to server IP "mail" subdomain pointing to server IP CNAME Records: "www" pointing to mail.subdomain "ftp" pointing to mail.subdomain "webmail" pointing to a mail-related subdomain MX Record: Pointing to the mail subdomain TXT Records: SPF record DMARC policy SRV Records: Various email protocol records Could you please confirm what CNAME records Roundcube expects for a standard webmail installation? I've configured a webmail CNAME record, but I want to verify this is correct. Is there a specific DNS record I should create for Roundcube to function properly? I've seen some installations use webmail.domain.tld as the access point, but I'm unsure if this is a requirement or just a convention. When I try to access Roundcube, I'm encountering configuration issues. I've attempted to set up the HestiaCP templates for Roundcube but received errors about missing template files. I would greatly appreciate your guidance on the proper DNS configuration to ensure Roundcube works seamlessly with my setup. If there are any documentation resources you could point me to regarding DNS requirements for Roundcube, that would also be extremely helpful.

3 2

Change appearance RoundCube front page
by tony＠yarraboy.com 05 Dec '25

05 Dec '25

Am baffled. My RoundCube front page has for a long time had three columns (folders, sender and message) and suddenly it has changed to two. The folders column is no longer showing. How can I revert to original layout? Tony Berry, Author and accredited editor (IPEd); Advanced member Chartered Institute of Editing and Proofreading; Diploma Professional Writing & Editing; Member Australian Society of Authors.

2 1

ZIGGO IP-adres maakt geen verbinding met XXXXXXX.nl/roundcube/
by henri＠kentaur.nl 04 Dec '25

04 Dec '25

ZIGGO IP-adres maakt geen verbinding met XXXXXXX.nl/roundcube/ Alleen als ik gebruik maak van een VPN (dus een ander IP-adres) kan ik contact maken of (RoundCube) webmail te gebruiken. Alle bookmarks links werken wel normaal. Mobiele telefoons met ODIDO of Libara (KPN) geven wel direct toegang. Meerdere browsers geprobeerd, Chrome, Edge, Firefox, Yahoo, Brave, Opera. ZIGGO-Helpdesk kent dit probleem nog niet en suggereert als laatste (na consultatie van deze ZIGGO-Community) een hard reset van de modem. Ik hoop op reactie/antwoord/hulp.... HENRI

2 2

Re: require_once / array_first() issue
by Jim Pazarena 26 Nov '25

26 Nov '25

On 2025-11-25 9:43 AM, Jim Pazarena wrote: > I am on FreeBSD (14.3p5). I did some updates. Now my roundcube (1.6.11) > webmail fails with this require_once() / array_first() error. > > And suggestions would be very much appreciated. > > [Tue Nov 25 09:36:04.095321 2025] [php:error] [pid 12559] [client > 23.235.68.254:49684] PHP Fatal error: Cannot redeclare function > array_first() in /u/roundcube/program/lib/Roundcube/bootstrap.php on > line 308\nStack trace:\n#0 /u/roundcube/index.php(40):require_once()\n#1 > {main}, referer: https://emailh.ca/ > > to respond to my own inquiry: I also left out that my php version was: 8.5.0b3 I just reverted to php 8.4.13 Roundcube works once again. Very odd. I will post these findings in the FreeBSD forum. Sorry for the bandwidth. -- Jim Pazarena roundcube(a)paz.bz Haida Gwaii - British Columbia - Canada

3 2

require_once / array_first() issue
by Jim Pazarena 25 Nov '25

25 Nov '25

I am on FreeBSD (14.3p5). I did some updates. Now my roundcube (1.6.11) webmail fails with this require_once() / array_first() error. And suggestions would be very much appreciated. [Tue Nov 25 09:36:04.095321 2025] [php:error] [pid 12559] [client 23.235.68.254:49684] PHP Fatal error: Cannot redeclare function array_first() in /u/roundcube/program/lib/Roundcube/bootstrap.php on line 308\nStack trace:\n#0 /u/roundcube/index.php(40):require_once()\n#1 {main}, referer: https://emailh.ca/ -- Jim Pazarena roundcube(a)paz.bz Haida Gwaii - British Columbia - Canada

1 0

Roundcube webmail 1.7 beta2 released
by Pablo Zimdahl 01 Oct '25

01 Oct '25

The development team is pleased to announce the second beta release for the next major version 1.7 of Roundcube webmail. With this milestone we introduce some more fixes, and bring full support for the early version of PHP 8.5. It does not include breaking changes (beyond those of 1.7-beta). Some noteworthy changes are: - Support PHP v8.5(-pre) without deprecation warnings. - Support IPv6 in database DSN (#9937) - Use `htmleditor` setting also for identity signature (#9954) - Fix regression in handling of non-unicode characters in a plain text message (#9953) - Fix parsing of inline styles that aren't well-formatted (#9948) - Support early MIME types for S/MIME encrypted messages (#9973) - Only apply fix_path for href attrib in <link>s (#9943) - Show homograph-warning-icon before email address, unify warning wording (#9945) - Show full details with warning icon in case of phishing suspicion (#9945) - Prepend group-names to display-name (#9945) Thanks to coco_melon for the reporting! - Wash the `name` attribute also on more elements (#9949) – Thanks to pwn.ai by Octagon Networks for the reporting! - Sanitize filename on download (#9960) - Drop Internet Explorer from supported browsers (#9963) - Enforce leading backslash for non-namespaced non-Roundcube uses (#9935) - Use asset_url() instead of get_skin_file() for deleteicon on contact edit form (#9933) - Several changes to the test tooling. For full details please see the release notes: https://github.com/roundcube/roundcubemail/releases/tag/1.7-beta2 This is a beta release and we recommend to test it on a separate environment. Migrate existing configs with either the installto.sh or the update.sh scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

1 0

Subscription of dovecot Shared Folders
by Wolfi 25 Sep '25

25 Sep '25

Hi Everyone! I'm using Roundcube in Docker. Everything is working fine except the Shared Folders. When I subscribe a shared folder it is visible in mail overview and on mail server the subscriptions file in Maildir is set correctly. After a reload of the RC website the subscriptions folder is disappeared and the shared folder in subscriptions file is also disappeared. Is there a setting in RC I could not find? Or is it a missing config on server? Thanks in advance, Wolfi

1 0

running low on disk space.
by joe＠3dprintingllc.net 06 Sep '25

06 Sep '25

Is there a way to add more disk space to my roundcube mail service.

5 4

Embracing Solar Systems in Melbourne
by andersonhannah520＠gmail.com 19 Aug '25

19 Aug '25

In Melbourne, the adoption of <a href="https://powerbandelectrical.com.au/location/solar-batteries-melbourne/">solar systems in Melbourne</a> has become an increasingly common choice for households and businesses looking to take control of their energy consumption while contributing to a more sustainable future. The city’s weather, which offers a good balance of sunny days throughout the year, supports efficient solar power generation even during cooler seasons. Rising electricity costs and growing concerns about climate change have prompted many residents to explore renewable energy options, with solar systems standing out as a reliable and cost effective solution in the long term. Modern solar technology has evolved to work efficiently under varying light conditions, making it well-suited to Melbourne’s often unpredictable weather. Government rebates and incentive programs have also played a role in encouraging installations, helping to reduce the initial financial barrier. For many, pairing a solar system with battery storage offers the additional benefit of energy independence, allowing them to store excess power for use during evenings or peak demand periods. This not only helps in reducing reliance on the grid but also provides a safeguard during outages. Beyond the practical advantages, the shift towards solar reflects a broader cultural change, with communities becoming more conscious of their environmental footprint and eager to make choices that support long term ecological health. Rooftops across the suburbs increasingly display solar panels, a visible sign of Melbourne’s commitment to renewable energy and a cleaner future. As technology continues to advance and awareness spreads, solar systems are likely to become an even more integral part of the city’s energy landscape, shaping the way Melburnians power their homes and businesses for decades to come.

7 8

Question about custom sound notifications in Roundcube
by soundbuttonspro.com＠gmail.com 16 Aug '25

16 Aug '25

Hello, I’ve been exploring ways to make webmail more engaging and user-friendly. One idea I had was to integrate custom sound notifications for incoming emails or specific actions (e.g., sending, deleting, archiving). Does Roundcube currently support using custom audio notifications, or is there a recommended plugin/extension approach for this? I believe this could improve accessibility and also add a touch of personalization for users. As someone who works with sound-related content (see https://soundbuttonspro.com/ ), I’m particularly interested in how Roundcube handles sound features and whether there are best practices for implementing them. Thanks in advance for your guidance,

2 1

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users