Dear Roundcube users
We just published updates to both stable versions 1.0 and 1.1 after fixing many minor bugs and adding some security improvements to the 1.1 release branch. Version 1.0.6 comes with cherry-picked fixes from the more recent version to ensure proper long term support especially in regards of security and compatibility.
The security-related fixes in particular are:
- XSS vulnerability in _mbox argument
- security improvement in contact photo handling
- potential info disclosure from temp directory
See the full changelog here: http://trac.roundcube.net/wiki/Changelog
Both versions are considered stable and we recommend to update all productive installations of Roundcube with either of these versions. Download them from https://roundcube.net/download
As usual, don't forget to backup your data before updating.
And there's one more thing:
Our crowdfunding campaign for Roundcube Next is still ongoing and has just been updated with more details of what we want to achieve. We'd much appreciate your support for this exciting new project. Please visit https://roundcu.be/next and spread the word about it.