Roundcube 1.6.20 and 1.7.5 Fix 20 Security Flaws, Including IMAP Command Injection
Do Son 
TL;DR
Roundcube released versions 1.6.20 and 1.7.5 on October 19, 2026, fixing 20 security issues. This Roundcube security update covers IMAP command injection, mail header injection, XSS, SSRF and CSRF flaws. Admins should upgrade all 1.6.x and 1.7.x servers.
Why It Matters
Roundcube is a popular open-source webmail client, and attackers target it often. In September, Canada’s Cyber Centre warned that a separate Roundcube SQL injection flaw was “actively exploited in the wild.” At that time, Shadowserver counted more than 523,000 Roundcube instances exposed online.
How the Attacks Work
IMAP command injection
Two bugs let attackers smuggle extra IMAP commands through line-break characters in the _uid and _flag parameters. As a result, a request could trigger mail server actions the user never intended.
Header injection and content bypasses
Four flaws allow mail header injection through the From name, the subject and other fields. In addition, three bugs bypass remote content blocking or CSS scoping in HTML messages.
Other notable fixes
- An SSRF filter bypass through NAT64 addresses
- An object injection risk in session handling
- A CSRF bypass in the mark-as-junk action
- An XSS flaw in password driver error responses
- A Modoboa password driver bug that could change another account’s password
- Unsafe image content passed to ImageMagick
Exploitation status
Roundcube has not assigned CVE IDs or severity scores yet. No exploitation in the wild or public PoC has been confirmed for these flaws.
Affected Versions
All Roundcube 1.6.x releases before 1.6.20 and 1.7.x releases before 1.7.5 are affected.
Patch and Mitigation Steps
- Upgrade to Roundcube 1.6.20 or 1.7.5.
- Review the full changelogs on GitHub before deploying.
- Disable unused plugins and password drivers.
The Roundcube security update announcement says the team “strongly recommend[s] to update all productive installations.” Given Roundcube’s history as a target, apply this Roundcube security update quickly.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
