Roundcube ships 17 security fixes across 1.7.6 and 1.6.21
Two updates, one day, and a pointed warning for admins clinging to the aging 1.6 LTS line.
Roundcube published two releases at once today. You get 1.7.6 for the mainline and 1.6.21 for the long-term-support branch, and both fix 17 recently disclosed flaws. The list reads like a webmail client's worst day: open redirects, IMAP command injection, mail header injection, Sieve script injection, SSRF, CSRF bypasses, a runaway-CPU denial-of-service, and an ImageMagick content-handling flaw that could turn malicious attachments into code execution.
Both went live at about 12:01 UTC, a minute apart. This is the same split pattern the project has leaned on for years, shipping mainline and LTS fixes together so both supported lines stay protected at the same time.
Lead developer Aleksander "Alec" Machniak didn't mince words this round. He again told everyone running Roundcube in production to update, but he also aimed a warning squarely at admins still on the four-year-old 1.6 LTS line. Backporting fixes, he said, has become "increasingly time consuming, annoying and error prone," and added that the branch "will be discontinued rather soon."
Eight of the seventeen fixes carry the same names.
Who found the flaws
Roundcube credits its reporters right in the release notes. This batch hands eight fixes to an anonymous collective going by Squirt1e, Atum, N0b0dy and Gh0u1L5. They are no strangers to Roundcube. That same quartet has shown up across multiple recent releases, including 1.7.3, 1.7.4 and 1.7.5, consistently clustering around CSRF, header injection, and script or filter injection.
They look like coordinated independent researchers working under shared handles rather than a single named person or one organization. For what it's worth, that makes them one of the most dependable sources of flaws in this particular stretch of software.
The remaining fixes spread across a wider crowd. The SSRF bypasses went to blacksw0rd and wyx98765, two names that have made the is_local_url filter their favorite target for many versions. CSRF bypasses came from skad00sh and threalwinky. Guang landed the CPU-loop DoS, and the ImageMagick flaw came from José Luis Sánchez Pérez at Cybersecurity Blue & Red Team.
Why the same bugs keep coming back
Roundcube is one of those pieces of software you have almost certainly never heard of but probably use anyway. It powers the "webmail" link on thousands of servers, from ISPs to universities to government agencies. It became cPanel's default webmail after it dropped SquirrelMail, and after a 2023 partnership it now sits under the Nextcloud umbrella. When your company's email runs at webmail.something, there's a decent chance Roundcube is underneath it, and that ubiquity is exactly what makes it a prize.
The core problem is that rendering mail from strangers is dangerous by design. An email is basically untrusted HTML shipped by someone who may want to hurt you, and Roundcube has to sanitize it before displaying anything. Researchers find a way to smuggle a little script through. The next release finds another hole.
Take the is_local_url() SSRF filter. It has been beaten again and again across versions, via NAT64 addresses, 6to4 ranges, hexadecimal IPv6-mapped IPv4, trailing-dot domain names, and nip.io or sslip.io DNS tricks. Each patch really just wins one round of whack-a-mole.
The commit gap tells the story of the LTS line, too. Since the 1.6.21 tag, 1,288 commits have landed on the mainline branch. That's a huge gap, and it's part of why Machniak is nudging people off 1.6. Keeping the old line safe means carrying years of divergent code forward, patch by patch. Not cheap, and exactly the kind of work that is "increasingly annoying and error prone."
What this means for you
Roundcube calls this batch a stable security update. National advisories are already lining up: the German BSI rated its last Roundcube advisory high at CVSS 8.1, and France's CERT-FR has been tracking the wave since late October. CVE numbers for this specific batch had not yet been published as of the release, though the pattern from prior batches suggests they will follow in the coming weeks.
The guidance is blunt. Update all production installations of 1.6.x and 1.7.x. Back up your data first, since an upgrade also runs database schema migrations. If you are still on 1.6 LTS, treat this as a signal to plan your move to 1.7 soon.
Keep in mind that distro packages tend to lag behind upstream, so a public install with a strict patch SLA may want the official tarball from roundcube.net or the official Docker image instead.
It's a fair bit of pressure on anyone holding onto 1.6, but here is the thing: the project is making it hard on purpose to push you toward 1.7. The release notes carry an unusual public nudge rather than a quiet advisory, and Roundcube says the branch is four years old and asks admins to "plan your upgrade to 1.7 soon."
These flaws are not theoretical. CVE-2025-49113, a post-authentication RCE via object deserialization, scored a 9.9 and left an estimated 84,000 instances exposed. State-sponsored groups have weaponized the same XSS class of flaws against European and Ukrainian government servers. Staying put, then, carries real risk.
Head here to the official 1.7.6 release notes, and here to the 1.6.21 release notes.
