LoginSign Up
← Back to all sparks
R

Roundcube

COMMS
Velocity5.0

Browser-based IMAP webmail client with a desktop-like interface

roundcube.net ↗

Roundcube is shipping matched security pairs across 1.7 and 1.6 LTS, roughly monthly.

security-patchingwebmaildual-branch-releasesxss-sanitizationssrf
◆Current state
Every release in this window is a security update, and they arrive in matched pairs — the same fix set landed on the 1.7 stable branch and backported to the 1.6 LTS branch minutes apart. The August pair closes eleven reported issues, including remote code execution through the markasjunk plugin's cmd_learn driver, IMAP command injection via LITERAL+ byte-count desynchronization, LDAP filter injection through unescaped substitution in search_filter, arbitrary Sieve script injection past managesieve_disabled_actions, multiple SSRF filter bypasses, and stored XSS. The June and July pairs follow the same structure with different findings.
◆Where it's heading
Roundcube is absorbing sustained external security-research attention and has settled into a repeatable response cadence: fix, pair the branches, ship. The recurring categories are telling — HTML and CSS sanitizer bypasses via SVG attributes, SSRF filters defeated by address-space and hostname tricks, and injection through plugin drivers — which means the same attack surfaces keep yielding new variants rather than being closed once. The 1.5 branch received its last pair in March; since 1.7.0 arrived in May, maintenance has narrowed to two branches instead of three.
◆Prediction
Expect the next release to be another 1.7/1.6 security pair rather than a feature drop, and to include further sanitizer or URL-fetch bypass fixes, since those two categories have recurred in every pair in this window.

◆Recent moves

  1. 10d ago

    1.7.3 fixes 11 issues including plugin RCE and IMAP injection

    The heaviest pair in this window: eleven reported vulnerabilities, led by remote code execution in the markasjunk plugin's cmd_learn driver and IMAP command injection through LITERAL+ byte-count desynchronization. It fits the established pattern of researcher-driven hardening on sanitizer, SSRF and plugin-driver surfaces rather than any change to what Roundcube does.

    View source ↗
  2. 10d ago

    1.6.18 backports the same 11 security fixes to the LTS branch

    The LTS twin of 1.7.3, published a minute earlier with an identical vulnerability list. It is the same fix set rather than separate work, and it is what keeps 1.6 deployments on the same security floor as 1.7.

    View source ↗
  3. 1mo ago

    1.6.17 fixes CVE-2026-54432/54433 and a TNEF decoder loop

    July's LTS release, carrying two assigned CVEs — a stored XSS via unescaped attachment MIME type and a zero-click stored XSS in plain-text rendering — plus an infinite loop and a DoS in the TNEF decoder. Message parsing joins sanitization as a recurring source of findings.

    View source ↗
  4. 1mo ago

    1.7.2 ships July's security set to the stable branch

    The 1.7 half of the July pair, with the same vulnerability list as 1.6.17 plus branch-specific fixes to static.php range handling and skin logo loading. Confirms the two-branch lockstep as the maintenance model.

    View source ↗
  5. 2mo ago

    1.6.16 fixes pre-auth SQL injection and arbitrary file delete

    June's LTS release, notable for two pre-authentication issues: SQL injection in the virtuser_query plugin and arbitrary file deletion through redis/memcache session poisoning. Code evaluation in the LDAP autovalues option was removed outright rather than patched.

    View source ↗
  6. 2mo ago

    1.7.1 pairs June's fixes with Enigma HKP key lookup

    The 1.7 twin of 1.6.16, carrying the same pre-auth SQL injection and file-delete fixes alongside automatic public key lookup over HKP v1 in Enigma. One of the few entries in this window where a non-security change ships at all.

    View source ↗