Roundcube webmail fixes injection, XSS and SSRF flaws
Original title: Roundcube webmail: multiple vulnerabilities prior to 1.6.20 / 1.7.5
Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.
Valtteri Vuorikoski reported that Roundcube, a webmail frontend, published security updates on October 19 as versions 1.6.20 and 1.7.5. The notice covers multiple command and header injection, XSS and SSRF, and miscellaneous flaws in earlier releases. One listed fix is IMAP command injection via CRLF in the _uid parameter of the mail/headers and mail/viewsource actions, reported by Wahab “NeoX” K. The feed text is truncated after that item.
Unconfirmed: The mailing-list text is truncated, so the full vulnerability list is not available here.
- Fixed releases are Roundcube 1.6.20 and 1.7.5.
- IMAP command injection used CRLF in the _uid parameter.
- The injection affects mail/headers and mail/viewsource actions.
- The posted list of further bugs is cut off.
Impact: IMAP command injection, XSS, and SSRF in the webmail frontend
| Product | Affected | Fixed in |
|---|---|---|
| Roundcube webmail | prior to 1.6.20 and 1.7.5 | 1.6.20 and 1.7.5 |
- 1.Upgrade Roundcube webmail to 1.6.20 or 1.7.5.
- Vendors
- Roundcube
- Products
- Roundcube webmail
From the original article
Posted by Valtteri Vuorikoski on Oct 20 Roundcube, a webmail frontend, released a security update on Oct 19 as versions https://roundcube. net/news/2026/10/19/security-updates-1. 6.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.