Roundcube, a webmail frontend, released versions 1.6.16 and 1.7.1 on May 24 that fix a variety of vulnerabilities. From the announcement <https://roundcube.net/news/2026/05/24/security-updates-1.6.16-and-1.7.1>:
Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy Fix CSS injection bypass in HTML sanitizer via SVG <animate attributeName="style">, reported by wooseokdotkim Fix pre-auth SQL injection in virtuserquery plugin via pregreplace backslash escape bypass, reported by skull Fix SSRF bypass via specific local address URLs Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team Fix bypass of remote image blocking via CSS var(), reported by Geame Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1 Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option, reported by Glendaenri As usual, CVE numbers are not provided in the announcement. See for example <https://security-tracker.debian.org/tracker/source-package/roundcube> for a list if interested.
Support for the 1.5 LTS branch has ended, so presumably it is and will remain vulnerable to some or all of these.
-Valtteri
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
Latest version: 1.7.3
Addendum: versions 1.5.15/1.6.15 were released March 29 that correct regressions introduced in 1.5.14/1.6.14 and fix one more cross-site issue:
SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by classnzm.
Announcement is at <https://roundcube.net/news/2026/03/29/security-updates-1.7-rc6-1.6.15-1.5.15>. This appears to be CVE-2026-35545.
-Valtteri
Roundcube, a webmail frontend, released versions 1.5.14 and 1.6.14 on March 18 with fixes to a multitude of vulnerabilities. The 1.7 pre-releases are also affected. From the release announcement <https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14>: Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. Fix bug where a password could get changed without providing the old password, reported by flydragon777. Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral. Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral. Fix fixed position mitigation bypass via use of !important, reported by nullcathedral. Fix XSS issue in a HTML attachment preview, reported by aikidosecurity. Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
The file write is apparently CVE-2026-35537. Roundcube still does not provide CVE numbers in their official announcements, interested parties can look them up for the rest for example at the Debian security tracker <https://security-tracker.debian.org/tracker/source-package/roundcube>.
-Valtteri
End of support: 5/10/2026, Latest version: 1.6.18
End of support: 5/10/2026, Latest version: 1.6.18
End of life: 5/10/2026, End of support: 7/25/2022, Latest version: 1.5.15
End of life: 5/10/2026, End of support: 7/25/2022, Latest version: 1.5.15
Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows XSS via a text/html e-mail message containing an SVG image with a USE element. This is related to washuri in rcubewashtml.php.