Roundcube Drops Emergency Security Updates for 12 Vulnerabilities Including Zero-Click XSS
The popular open-source webmail client has released simultaneous patches for both its current stable and LTS branches today. Roundcube 1.7.4 and 1.6.19 land within a minute of each other, addressing a dozen recently reported security flaws that range from email header injection to a zero-click stored cross-site scripting vulnerability triggered simply by opening a mailbox.
If you're running Roundcube as your primary mail interface, the timeline matters more than usual. Both branches ship with verified GPG signatures from lead maintainer Aleksander Machniak. The project explicitly describes both builds as "stable" and "recommended for all productive installations."
The vulnerabilities in plain English
Most of these fixes target crafted input slipping past sanitizers. A bare carriage return in the compose form's subject field smuggles arbitrary SMTP headers into outgoing messages. The same trick works when a recipient display name contains a C-style escape sequence. Another researcher found that the organization field of a saved sender identity wasn't properly sanitized, creating yet another header injection vector.
The zero-click stored XSS is worth a closer look. A specially crafted Windows TNEF attachment embeds malicious HTML tags directly into the preview URL. Users don't need to click anything. Loading the message list triggers the payload. That's a particularly nasty touch for a webmail client, and it explains why security teams are scrambling to patch.
SSRF issues round out the serious findings. The CSS proxy can be tricked into resolving internal network addresses using hexadecimal IPv6-mapped IPv4 notation. A stylesheet URL ending with a trailing dot bypasses the is_local_url() check entirely. Remote content blocking gets bypassed by CSS escapes within url() attributes or SVG SMIL <animate> elements.
Attribution and disclosure posture
The project credits an external community of researchers rather than assigning formal CVE IDs. Joshua Rogers reported both the HTML editor XSS and the contact group authorization bypass. dogeshark flagged two separate header injection issues. Zach Hanley of Horizon3.ai identified the CSS declaration smuggling via un-encoded ampersands.
The disclosure model has always been advisory-style. No coordinated vulnerability process with NVD assignment. The project uses its own attribution format, like CVE-Hunter-Leo, for reporters who prefer to stay anonymous. That's not unusual for a project of this scale, but it does mean security teams need to track the GitHub release notes directly rather than waiting for CVE assignments.
What you need to do
Update to 1.7.4 if you're on the current stable branch. Move to 1.6.19 if you're on LTS. The project recommends backing up your data before upgrading, which is standard practice. Nextcloud users should verify the Roundcube package version in their distribution as well, since Nextcloud bundles its own copy of the webmail client.
Head here to the official announcement for full details. Keep an eye on the GitHub release pages for 1.7.4 and 1.6.19 if you want the raw commit logs. The patch notes list 12 fixes across CSS injection, header smuggling, stored XSS, authorization bypass, SSRF, and remote content blocking. Nothing left for the community to patch in.
