Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Roundcube 1.6.20 and 1.7.5 fix IMAP injection, XSS and SSRF

2 sources · 2 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Roundcube 1.6.20 and 1.7.5, released October 19, patch multiple webmail flaws; Canada issued advisory AV26-1075 with no CVE or exploitation details.

Roundcube published security updates on October 19 as versions 1.6.20 and 1.7.5 for its webmail frontend. Valtteri Vuorikoski reported that the updates cover command and header injection, XSS, SSRF and miscellaneous flaws in earlier releases. One listed fix is IMAP command injection via CRLF in the _uid parameter of the mail/headers and mail/viewsource actions, reported by Wahab “NeoX” K.; the published list of further bugs is truncated. On October 22 the Canadian Centre for Cyber Security issued AV26-1075, stating that Roundcube Webmail before 1.6.20 and before 1.7.5 is affected and directing users to those updates. The Canadian bulletin names no flaws, CVE identifiers or exploitation status.

Key facts
  • Fixed releases are Roundcube 1.6.20 and 1.7.5, published October 19.
  • Versions before 1.6.20 and before 1.7.5 are affected.
  • IMAP command injection used CRLF in the _uid parameter of mail/headers and mail/viewsource.
  • Wahab “NeoX” K. reported the IMAP injection; Valtteri Vuorikoski reported the update notice.
  • Canadian advisory AV26-1075 gives no CVE identifiers or exploitation status.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Oct 19, 2026Roundcube releases security updates 1.6.20 and 1.7.5 · oss-security
  2. Oct 22, 2026Canada issues Roundcube advisory AV26-1075 · Canadian Centre for Cyber Security

What each outlet adds

beyond the shared facts
  • oss-securityNames IMAP CRLF injection, XSS, SSRF and the reporters
  • Canadian Centre for Cyber SecurityIssues AV26-1075 without CVEs, flaw names or exploitation status
Vendors
Roundcube
Products
Roundcube webmailRoundcube Webmail
Organizations
Canadian Centre for Cyber Security
Countries
Canada

Coverage

oldest first · one row per article · UTC
  1. · 5d ago oss-securityFirst report

    Roundcube webmail fixes injection, XSS and SSRF flaws

    Versions 1.6.20 and 1.7.5, released October 19, fix IMAP command injection via CRLF plus XSS and SSRF issues.

  2. · 3d ago Canadian Centre for Cyber Security

    Roundcube Webmail before 1.6.20 and 1.7.5 has security flaws

    Canadian advisory AV26-1075 names the fixed releases but gives no CVE identifiers or impact details.