ROUNDCUBE has released security updates for versions 1.6.20 and 1.7.5 on 19 October 2026, addressing a total of 20 vulnerabilities spanning IMAP command handling, header processing, and several webmail-specific flaws. The advisory notes that these fixes cover IMAP command injection, mail header injection, cross-site scripting (XSS), server-side request forgery (SSRF), and CSRF vulnerabilities, and it urges administrators to upgrade all 1.6.x and 1.7.x installations to the respective patched releases.
The affected versions are all Roundcube 1.6.x releases prior to 1.6.20 and all 1.7.x releases prior to 1.7.5. The update introduces multiple mitigations, including a fix for IMAP command smuggling via line breaks in the _uid and _flag parameters, four header injection issues in fields such as From and Subject, and three bypasses affecting content blocking or CSS scoping in HTML messages.
Other notable fixes include an SSRF filter bypass through NAT64 addresses, an object injection risk in session handling, a CSRF bypass in the mark-as-junk action, an XSS issue in password driver error responses, a Modoboa password driver bug that could alter another user’s password, and unsafe image content handling with ImageMagick. The article notes that no CVE IDs have been assigned and no exploitation in the wild or PoCs are confirmed for these flaws at the time of reporting. Administrators are advised to upgrade promptly and review the full changelogs before deployment.