Roundcube has released security updates for the 1.6 LTS and 1.7 branches of Roundcube Webmail, moving those branches to 1.6.20 and 1.7.5 with fixes for 20 security issues. The Roundcube Project announced the updates on October 19, 2026.
Roundcube fixed two IMAP command injection paths involving carriage-return/line-feed (CRLF) sequences: one in the _uid parameter for the mail/headers and mail/viewsource actions, and another in the _flag parameter for the mail/mark action.
The release also addresses several mail header injection paths involving the Bounce action, message forwarding, inline image data URIs and request parameters such as References, In-Reply-To, Message-ID and From.
Other fixes cover a server-side request forgery (SSRF) filter bypass involving NAT64, remote content blocking bypasses through SVG SMIL and CSS escapes, a cross-site request forgery (CSRF) validation bypass in mark-as-junk, a cross-site scripting (XSS) issue in password driver error responses, an object injection primitive in session handling, ImageMagick-related image handling problems, a CSS scoping bypass in HTML messages, a Modoboa password driver issue and unsafe SquirrelMail import file path handling.
Debian identifies 20 CVEs, including an IMAP command-injection flaw
Debian’s October 23 security advisory, DSA-6579-1, lists 20 CVEs addressed by the Roundcube updates, including CVE-2026-113386. Debian’s tracker describes that flaw as IMAP command injection affecting Roundcube before 1.6.20 and 1.7.x before 1.7.5. A remote authenticated attacker can inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
That authentication requirement changes the threat model, but it does not remove the need to patch. Webmail access depends on ordinary user accounts.
No active exploitation claim in the upstream advisory
Roundcube’s advisory says the updates address recently reported vulnerabilities and strongly recommends updating production 1.6.x and 1.7.x installations. It does not say the newly fixed issues are being exploited.
The Canadian Centre for Cyber Security followed with advisory AV26-1075 on October 22. It lists Roundcube Webmail prior to 1.6.20 and prior to 1.7.5 as affected, and encourages users and administrators to review Roundcube’s links and apply necessary updates as they become available.
Distribution packages may lag upstream
Some Roundcube installations are updated through Linux distribution packages or hosting-control software rather than direct upstream downloads. Those environments need package-level confirmation, because an upstream release does not automatically mean the hosted package or panel-integrated build has been updated.
Debian’s October 23 advisory confirms that the vulnerabilities have been fixed for trixie in security package 1.6.20+dfsg-0+deb13u1. Its tracker also lists unstable as fixed, while bookworm packages remained marked vulnerable at the time of checking. Administrators should verify the package version provided by their distribution or hosting provider.
Fixed versions to confirm
The fixed upstream versions are Roundcube Webmail 1.6.20 for the 1.6 LTS branch and 1.7.5 for the 1.7 branch. GitHub release notes for both branches describe the new versions as stable. Older 1.6.x and 1.7.x installations should be reviewed unless a vendor package clearly backports the security fixes.
For directly maintained installations, back up data first, as the GitHub release notes advise. Then apply the appropriate update, confirm the version after deployment and review any Roundcube-related package advisories from the operating system or hosting provider.
Get new small business insights by email
Practical ideas and useful articles to help you make better business decisions.
Tech Help Canada Staff researches, writes, and reviews practical content for business owners and professionals. Our coverage spans business, marketing, SEO, technology, and the tools and systems people use to grow and operate online. We focus on clear, useful information backed by research, hands-on experience, and editorial review. Learn more about our team and editorial standards. Need help with something? Contact Us
