LoginSign Up
← Back to all sparks
R

Roundcube

COMMS
Velocity5.0

Browser-based IMAP webmail client with a desktop-like interface

roundcube.net ↗

After four years, Roundcube 1.7 lands — and the release stream is otherwise all CVEs

webmailphpsecurityoidcself-hostedlts
◆Current state
Roundcube maintains two lines in lockstep: 1.6 as LTS and 1.7 as stable, with security fixes released to both on the same day. The vulnerability stream is heavy and varied — stored XSS via an unescaped attachment MIME type (CVE-2026-54432), a pre-auth SQL injection in the virtuser_query plugin, CSS injection through SVG animate, SSRF bypasses via local address URLs, an infinite loop in the TNEF decoder. Version 1.7.0, released in May after almost four years of development, is the only feature release in the window.
◆Where it's heading
The arc is a long-lived webmail codebase paying down structural risk. 1.7.0's headline changes are defensive rather than user-facing: a mandatory public_html/ entry point so installations aren't exposed by default, improved OAuth2/OIDC support including discovery and logout, removed code bloat and automated code style and quality checks. Everything since has been paired security releases across both lines, several of them reporting classes of bug — sanitizer bypasses, injection through plugin queries — that the 1.7 hardening work is aimed at. Expect the security cadence to stay high while the 1.6 LTS remains supported.
◆Prediction
Expect continued same-day paired security releases on 1.6 and 1.7, with 1.7.x accruing incremental OIDC and sanitizer hardening before any 1.8 work becomes visible.

◆Recent moves

  1. 26d ago

    Roundcube LTS patches attachment XSS, SSRF and a TNEF loop

    The LTS half of a paired security release: stored XSS through an unescaped attachment MIME type, password-plugin flaws using a session-injected username, an SSRF bypass, and an infinite loop in the winmail.dat decoder. Standard for this line's cadence.

    View source ↗
  2. 26d ago

    Roundcube 1.7 gets the same attachment XSS and SSRF fixes

    The stable-line twin of the 1.6.17 security release, shipped within a minute of it. The paired-release pattern is how Roundcube keeps LTS and stable users on the same security footing.

    View source ↗
  3. 1mo ago

    Roundcube LTS fixes a pre-auth SQL injection in virtuser_query

    The most serious item in the window: a pre-authentication SQL injection in the virtuser_query plugin via a preg_replace escape bypass, alongside a CSS injection bypass through SVG animate and further SSRF fixes. Pre-auth reachability makes this one urgent for anyone running the plugin.

    View source ↗
  4. 1mo ago

    Roundcube 1.7.1 carries the pre-auth SQL injection fixes

    The stable-line counterpart to 1.6.16, covering the same virtuser_query injection, sanitizer bypass and draft-restore XSS. Both lines patched the same afternoon.

    View source ↗
  5. 2mo ago

    Roundcube Webmail 1.7.0

    ⚡ SPARK

    The only feature release in the window and the reference point for everything after it: four years of work landing breaking changes, a mandatory public_html/ entry point and modern OIDC support. The security releases that follow are hardening on top of this footing.

    View source ↗
  6. 4mo ago

    Roundcube 1.6.15 fixes an SVG animate bypass and search regressions

    Patches remote image loading via SVG animate FUNCIRI attributes plus regressions from the prior release, including non-ASCII mail search failures. Regression repair alongside the vulnerability fix.

    View source ↗