LoginSign Up
← Back to all sparks
R

Roundcube

COMMS
Velocity5.0

Browser-based IMAP webmail client with a desktop-like interface

roundcube.net ↗

Roundcube patches 28+ vulnerabilities across two branches in a five-month hardening sprint

securityxssssrfemail-securitylts-maintenanceopen-source
◆Current state
Roundcube has shipped six security releases across its main 1.7.x and LTS 1.6.x branches since June, patching a cumulative 28+ vulnerabilities including an RCE via the markasjunk plugin's cmd_learn driver, IMAP command injection through LITERAL+ byte-count desynchronization, multiple SSRF bypasses, cross-user contact group access, and zero-click stored XSS. The simultaneous dual-branch cadence shows active maintenance of both lines.
◆Where it's heading
The volume and variety of external security reports — from Horizon3.ai, Samsung R&D, pwn.ai, and independent researchers — indicates Roundcube's attack surface is under sustained scrutiny. The 1.7.0 release in May introduced meaningful features (Markdown rendering, improved OAuth2/OIDC, mandatory public_html entry point), but the months since have been consumed by patching. Feature development on 1.7.x appears paused until the security debt settles.
◆Prediction
Another paired security release across 1.7.x and 1.6.x is likely within 6-8 weeks given the cadence. The SSRF and CSS parsing issues have required multiple iterations to close fully, suggesting the hardening work isn't finished.

◆Recent moves

  1. 8d ago

    Roundcube Webmail 1.7.4

    Version 1.7.4 patches 12 vulnerabilities reported by external researchers, including CSS declaration smuggling, three email header injection vectors, a zero-click stored XSS via TNEF MIME tags, and an SSRF bypass using hexadecimal IPv6-mapped IPv4 addresses. The breadth continues the pattern of coordinated researcher disclosure against Roundcube's HTML and CSS handling.

    View source ↗
  2. 8d ago

    Roundcube Webmail 1.6.19

    Version 1.6.19 applies the same 12-vulnerability patch set to the LTS branch, maintaining parity with 1.7.4. The consistent dual-branch release pattern ensures installations that cannot migrate to 1.7.x still receive critical security fixes.

    View source ↗
  3. 1mo ago

    Roundcube Webmail 1.7.3

    Version 1.7.3 addresses 11 vulnerabilities including an RCE via the markasjunk plugin's cmd_learn driver, IMAP command injection through LITERAL+ byte-count desynchronization, and a password driver leaking authentication tokens to user-controlled hosts — the most severe batch in this cycle. These are authenticated-user vectors, but the RCE is the most serious class of issue Roundcube has patched this cycle.

    View source ↗
  4. 1mo ago

    Roundcube Webmail 1.6.18

    Version 1.6.18 ports the same 11-vulnerability patch set to the LTS branch, including the RCE fix. Same scope as 1.7.3 across all security items with one additional PHP error fix.

    View source ↗
  5. 2mo ago

    Roundcube Webmail 1.6.17

    Version 1.6.17 covers six vulnerabilities including two CVEs for stored XSS, a DoS via crafted TNEF files, and password plugin session injection issues. An HKP v1 key lookup for OpenPGP/Enigma is a minor feature addition bundled with the security release.

    View source ↗
  6. 2mo ago

    Roundcube Webmail 1.7.2

    Version 1.7.2 matches 1.6.17's security scope on the main branch, and also ships several non-security fixes: OIDC backchannel logout improvements, vCard import corrections, and a revert of an encoding change that caused HTML part handling issues. The bundled fixes are more substantial than in subsequent security-only releases.

    View source ↗