Roundcube Webmail Patches 11 Critical Vulnerabilities in Emergency 1.6.18 and 1.7.3 Updates
The popular open-source mail client is moving faster than attackers, but the repeated sanitization failures suggest the underlying code needs a rethink.
Roundcube dropped two emergency security releases on August 9, 2026. Version 1.6.18 covers the LTS branch while 1.7.3 targets the current stable line, and both scrub eleven distinct flaws from the codebase. If you're running a self-hosted webmail setup, it's time to update. The patch covers everything from pre-authentication IMAP injection to arbitrary code execution via a default plugin.
This isn't Roundcube's first rodeo with emergency patches this year. The team has rolled out security fixes roughly every five to six weeks since February, responding to what looks like active exploitation pressure. Five rounds of updates in nine months is a lot for any project. It says something when an open-source team has to patch itself into the ground just to keep mail servers safe. Plugin architectures have always been a liability, though. Roundcube's markasjunk plugin just proved it again.
The critical flaws are scattered across nearly every layer of the application. The most alarming one sits in the markasjunk plugin. If that plugin is enabled, an unauthenticated attacker can craft a malicious email that triggers the cmd_learn driver and runs arbitrary commands on your mail server. No login required. Next, Horizon3.ai researchers flagged an IMAP command injection rooted in LITERAL+ byte-count desynchronization. It's a protocol-level quirk that lets attackers slip in forged commands before authentication even happens.
Milan Hoppe, who found four separate issues in this release, also uncovered an LDAP filter injection that plays havoc with the search_filter config, plus an arbitrary Sieve script injection that sidesteps the managesieve_disabled_actions guard. The SSRF filter gets tripped up by shared-memory IPv4 ranges, link-local IPv6 addresses, and dynamic DNS services like nip.io and sslip.io. It's a familiar pattern. Three releases in a row have patched the same HTML sanitization pipeline, with each fix being outsmarted by the next. CSS variables, SVG attributes, DNS rebinding. The core rendering logic clearly needs a full rewrite rather than band-aids.
Rounding out the list are a password modoboa driver token leak, remote content blocking bypasses that still let tracking pixels slip through, and a stored XSS that survives when a victim gets added to a spoofed contact list. The real-world impact here is substantial. CVE-2026-54433, that zero-click XSS from the July update, is still a major headache. Open an email in the preview pane and JavaScript runs. Account compromise happens before you can click delete. That vulnerability alone should be enough to force an immediate update.
What You Should Do Right Now
Update to 1.6.18 or 1.7.3. Immediately. Every unpatched instance is a sitting duck for pre-auth IMAP injection, zero-click XSS, or the markasjunk RCE vector. If you aren't actively using the markasjunk plugin, disable it. It's an unnecessary attack surface. Audit your Sieve filter rules and LDAP search_filter configurations for anything that looks out of place. The SSRF and CSS sanitization issues keep popping up because the underlying HTML pipeline treats each bypass as an isolated incident rather than a systemic flaw.
Head to the official Roundcube announcement for the full disclosure details and known issues. The GitHub release page for 1.7.3 has the complete changelog and patch notes. Keep your systems patched, and don't sleep on these rapid release cycles.
