Users

users@lists.roundcube.net

2974 discussions

[RCD] Security updates 1.6.14 and 1.5.14 (and 1.7-rc5) released
by Aleksander Machniak 18 Mar '26

18 Mar '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. They contain fixes for recently reported set of security vulnerabilities. ## Security fixes - Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. - Fix bug where a password could get changed without providing the old password, reported by flydragon777. - Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. - Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral. - Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral. - Fix fixed position mitigation bypass via use of !important, reported by nullcathedral. - Fix XSS issue in a HTML attachment preview, reported by aikido_security. - Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. See the full changelogs in the release notes on the Github download pages for the updated versions - https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5 - https://github.com/roundcube/roundcubemail/releases/tag/1.6.14 - https://github.com/roundcube/roundcubemail/releases/tag/1.5.14 We strongly recommend to update your productive installations of Roundcube with this new versions. -- Alec

1 0

add alt+s to send the email?
by Marc 10 Mar '26

10 Mar '26

Maybe good to standard support alt+s to send the email (outlook) and maybe also add whatever apple mail key combination uses.

3 2

slow with sso
by Marc 08 Mar '26

08 Mar '26

I am testing a bit with single sign on, but I have the impression the whole interface is quite a bit slower than not using this single sign on. Using dovecot 2.3 still with keycloak. Anyone having the same experience, maybe I did not configure this optimal?

1 0

Roundcube webmail 1.7 RC4 released
by Pablo Zimdahl 26 Feb '26

26 Feb '26

We just published the fourth release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two minor issues, it's mostly published to fix a file permission problem in the previous release v1.7-rc3. The changes are: - Ensure correct file permissions when building a release. - Installer: Fix broken link to download the created configuration file (#10092) The tarballs can be downloaded [from roundcube.net/download](https://roundcube.net/download/). Or directly from [the release page at github.com](https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc4). We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

2 1

INBOX shows 'No messages found' but messages exist in Email Disk Usage
by Nikolas Adi 18 Feb '26

18 Feb '26

Dear Roundcube Support Team, I am experiencing an issue with one of our email accounts hosted on cPanel (Niagahoster). Email account: *pajak.stp(a)tstjateng.co.id* <pajak.stp(a)tstjateng.co.id> Problem description: - In Roundcube Webmail, the INBOX displays the message: *"No messages found"*. - However, in cPanel → Email Disk Usage, it shows that there are *49 messages in the INBOX*. - Email storage is not full (396.91 MB used out of 1 GB). - There are no active email filters. - The INBOX folder is subscribed (default and cannot be disabled). This indicates that the messages physically exist on the server, but Roundcube is unable to display them. Could this be related to: - IMAP index corruption? - Dovecot index/cache issue? - Roundcube cache problem? Please advise on the recommended steps to resolve this issue. Thank you for your assistance. Best regards, Niko

4 4

Roundcube webmail 1.7 RC3 released
by Pablo Zimdahl 10 Feb '26

10 Feb '26

We just published the third release candidate for the next major version 1.7 of Roundcube webmail. This release fixes two security issues, and contains a few more fixes for several issues. The security fixes are: - Fix CSS injection vulnerability reported by CERT Polska. - Fix remote image blocking bypass via SVG content reported by nullcathedral. For the full changelog please see the release page: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3. The tarballs can be downloaded via roundcube.net: https://roundcube.net/download/ Or directly from the release page at github.com: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3 We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don't forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München) Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

1 0

Security updates 1.5.13 and 1.6.13 released
by Aleksander Machniak 08 Feb '26

08 Feb '26

We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities. Security fixes: - Fix CSS injection vulnerability reported by CERT Polska. - Fix remote image blocking bypass via SVG content reported by nullcathedral. See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.13 and 1.5.13. https://github.com/roundcube/roundcubemail/releases/tag/1.6.13 https://github.com/roundcube/roundcubemail/releases/tag/1.5.13 We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions. -- Alec

1 0

Roundcube in a rootless podman container
by Thing 29 Jan '26

29 Jan '26

Hi, I want to upgrade my roundcube setup and I am thinking of using a container this time. Has anyone done so and know of good docs for rootless podman? mysql would stay as a VM. regards Steven

2 1

Roundcube 1.7 RC released
by Pablo Zimdahl 29 Jan '26

29 Jan '26

The development team is pleased to announce the release candidate for the next major version 1.7 of Roundcube webmail! With this milestone we introduce a few breaking changes (see below) and some further improvements in comparison to 1.7-beta2. Some noteworthy changes are: * Add scope parameter to contact search (#9863) * Add ability to chose from all available contact fields on CSV import (#9419) * Add a new plugin called `markdown_editor` that provides an alternative editor to compose emails using Markdown syntax. * Add `rel=’noopener’` to all links opening in a new window to mitigate against misuse in older browsers. Breaking Changes: * Remove `contact_search_name` option in favor of `contactlist_name_template` (#9832) * Replace session attribute `changed` by `expires_at` (to allow for variable session lengths per-user in a future change). * Password: Removed the (insecure) `virtualmin` driver (#8007) For full details and download links please read the release notes: https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc We believe it is production ready, but we recommend to test it on a separate environment. Migrate existing configs with either the `installto.sh` or the `update.sh` scripts. And don’t forget to backup your data before installing it! Regards, Pablo -- Pablo Zimdahl Software Engineer oOo Nextcloud - Regain control over your data pablo.zimdahl(a)nextcloud.com nextcloud.com +49 711 25 24 28 90 Nextcloud GmbH Hauptmannsreute 44A, 70192 Stuttgart, Germany GF: Frank Karlitschek HRB 227086 (AG München)

2 1

Is there a logfile for enduser activity in Roundcube?
by Graham Spillman 27 Jan '26

27 Jan '26

My Welcome email suggests I use email to submit a new posting I am, of course, a newbie to this forum I wish to post this as a new thread. I have searched widely for RoundCube related issues There are very few. One or two similar in 2008, long ago fixed This is a last ditch request for knowledge of any diagnostic log files that might exist when a user connects to his RoundCube webmail server Graham Spillman ============== Our local vicar uses Roundcube 1.6.12 to circulate the parish newsletter to church members The contents are technically very ordinary - plain text body plus a number of attachments, mainly PDFs, or possibly MS Word He emails himself weekly, with Blind copies to his 250+ parishioners What could go wrong? ANSWER: the ATTACHMENTS GO MISSING, on arrival into all Inboxes His Inbox lists the email with the paperclip attachment symbol, but on opening the mail, there are no attachments. I have seen a screenshot myself This has happened two or three times in recent weeks I'm pretty sure there have been no changes to his PC in AGES. QUESTION Does RoundCube record any log of client user actions at the browser end?? Is there any record anywhere of what the user actually did when intended attachments have gone AWOL? spilly80

2 2

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

Users