Roundcube ships 20 security fixes across its 1.6.20 and 1.7.5 releases
Two webmail branches. One patch set. Your inbox probably depends on it.
Roundcube released two security updates today and they landed just a minute apart. Version 1.6.20 went out at 07:01 CEST. Version 1.7.5 followed at 07:02. Both came from lead developer Aleksander Machniak, the Polish programmer who goes by "Alec" and posts under the GitHub handle @alecpl.
Each fix set carries the same 20 recently reported vulnerabilities. For a project this size, that's one of the bigger single-day security sweeps it has pulled off in recent memory. Roundcube isn't mincing words in the announcement. "We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with these new versions."
Nobody uses it. Everyone uses it.
Roundcube is a textbook case of invisible infrastructure. Most people who log into a webmail inbox their provider handed them have no idea it is running underneath. It draws almost zero consumer press, which is arguably ideal for something this widely deployed.
Yet it quietly serves as the default webmail backend for a large chunk of the small- and medium-sized hosting market, and it ships pre-installed inside cPanel, the ubiquitous hosting control panel. One deployment can serve thousands of mailboxes at once. A single vulnerability rarely stays a single-victim problem for long.
That gap between Roundcube's modest profile and its real blast radius is exactly why researchers keep poking at it.
Where the two versions differ
Roundcube keeps two supported lines at any given moment. The mainline branch pulls in fresh features, while the older one slips into long-term-support mode and, by design, receives security fixes only.
1.7.0 shipped on 10 May 2026 after nearly four years of work, pushing the previous line, the 1.6.x series, first released on 28 July 2022, into LTS. So 1.6.20 and 1.7.5 are just the current versions of those two live branches, and the dual-release pattern here is standard for the project. 1.7.5 sits at commit 26d1b07 and is flagged as the repo's Latest release, with 186 commits already queued behind it toward the next round.
1.6.20 stays security only, as LTS should. 1.7.5 wraps the same 20 fixes around a handful of non-security tweaks, including letting the installer destroy its own session cookie, repairing a PGP keyring sync bug in the Enigma plugin, and fixing the exit code of healthcheck.sh for container setups. If you're on the LTS line, 1.6.20 is your patch. Mainline users should move to 1.7.5.
What the 20 fixes actually are
The project lists them flatly, but the fixes cluster around a few recurring battlefields.
Email sanitization tops the list. Roundcube strips or neutralizes external content in HTML mail unless you opt in, and researchers keep finding new routes past that filter. This batch closes an SVG SMIL by-attribute bypass (reported by Milan Hoppe) plus a CSS-escape bypass in FuncIRI attributes — note the "again" in the release note, which is a dead giveaway that this is a long-running saga tracing from CVE-2026-35540 through CVE-2026-75006.
The injection flaws are the more dangerous half. IMAP command injection via CRLF in the _uid and _flag parameters can let an attacker smuggle extra commands past the mail server, while header injection across several parameters can forge parts of a message. Those are classic stepping stones to disclosure, phishing, and worse, and a closely related IMAP variant (CVE-2026-75002) was already patched in 1.6.18 and 1.7.3.
The supporting cast fills out the rest: SSRF bypasses via NAT64, ImageMagick resource-limit gaps during thumbnail generation, a session-object injection in rcube_session::unserialize(), a CSRF gap in the mark-as-junk action, an XSS in password-driver error responses, and a couple of cross-account security bugs.
Many of these are follow-ups to flaws already patched earlier in 2026. It's a bit of a whack-a-mole situation at this point, with each fix spawning another bypass.
Who keeps the lights on
Roundcube credits reporters by handle, which gives a rare peek at the community watching webmail security. One collective, Squirt1e, Atum, N0b0dy, and Gh0u1L5, appears on 8 of the 20 fixes, nearly half this batch. That coordinated credit looks like an organized team rather than a pile of isolated hobbyists.
Milan Hoppe is another recurring 2026 name, credited across the SSRF, CSS-proxy, and alias-login fixes. Then there's Paulos Yibelo, a security engineer at Amazon tied to the autonomous pentesting platform pwn.ai, who took credit for the ImageMagick attachment-resize issue. His entry point is a reminder that even open-source security now pulls in findings surfaced by commercial tooling, not just volunteers.
It's a rather impressive distribution for a project that draws so little attention for itself.
Why these patch notes aren't just paper
No individual CVE numbers have been publicly assigned to this batch as of writing, though the project and its numbering authorities usually move in shortly after. Historically Roundcube tags essentially every item, so numbers for this round are expected soon.
For context, the bugs behind this kind of batch have actually reached production. CVE-2026-48842, a pre-auth SQL injection, drew an "in the wild" exploitation warning from the Canadian Centre for Cyber Security. CVE-2025-49113, a critical authenticated PHP object-deserialization RCE, ended up in CISA's Known Exploited Vulnerabilities catalog. The sanitization cat-and-mouse is real, and the people on either side aren't idle.
Here's the bottom line: if you or your provider run Roundcube, update. Back up your data first, as the project advises, then move to 1.6.20 on the LTS line or 1.7.5 on mainline.
Release Roundcube Webmail 1.7.5 · roundcube/roundcubemail
This is a security update to the version 1.7 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix IMAP command injection via CRLF in _uid parameter of mail/he...
Release Roundcube Webmail 1.6.20 · roundcube/roundcubemail
This is a security update to the version 1.6 of Roundcube Webmail. It provides fixes to recently reported security vulnerabilities: Fix IMAP command injection via CRLF in _uid parameter of mail/he...
