2026-03-29T10:12:09+00:00 https://roundcube.net Roundcube Webmail Dev Team 2026-03-29T00:00:00+00:00 https://roundcube.net/news/2026/03/29/security-updates-1.7-rc6-1.6.15-1.5.15 <p>We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. They contain fixes for recently reported set of security vulnerabilities.</p> <h2 id="security-fixes">Security fixes</h2> <ul> <li>SVG Animate FUNCIRI Attribute Bypass — Remote Image Loading via fill/filter/stroke, reported by class_nzm.</li> </ul> <p>See the full changelogs in the release notes on the Github download pages for the updated versions</p> <ul> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc6">1.7-rc6</a></li> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.6.15">1.6.15</a></li> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.5.15">1.5.15</a>.</li> </ul> <p>We strongly recommend to update your productive installations of Roundcube with this new versions.</p> 2026-03-18T00:00:00+00:00 https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14 <p>We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7. They contain fixes for recently reported set of security vulnerabilities.</p> <h2 id="security-fixes">Security fixes</h2> <ul> <li>Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.</li> <li>Fix bug where a password could get changed without providing the old password, reported by flydragon777.</li> <li>Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.</li> <li>Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.</li> <li>Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.</li> <li>Fix fixed position mitigation bypass via use of !important, reported by nullcathedral.</li> <li>Fix XSS issue in a HTML attachment preview, reported by aikido_security.</li> <li>Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.</li> </ul> <p>See the full changelogs in the release notes on the Github download pages for the updated versions</p> <ul> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5">1.7-rc5</a></li> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.6.14">1.6.14</a></li> <li><a href="https://github.com/roundcube/roundcubemail/releases/tag/1.5.14">1.5.14</a>.</li> </ul> <p>We strongly recommend to update your productive installations of Roundcube with this new versions.</p> 2026-02-13T00:00:00+00:00 https://roundcube.net/news/2026/02/13/roundcube-1.7-rc4-released <p>We just published the fourth release candidate for the next major version 1.7 of Roundcube webmail.</p> <p>This release fixes two minor issues, it’s mostly published to fix a file permission problem in the previous release v1.7-rc3.</p> <p>The changes are:</p> <ul> <li>Ensure correct file permissions when building a release.</li> <li>Installer: Fix broken link to download the created configuration file (#10092)</li> </ul> <p>The tarballs can be downloaded <a href="https://roundcube.net/download/">from roundcube.net/download</a>.</p> <p>Or directly from <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc4">the release page at github.com</a>.</p> <p>We believe it is production ready, but we recommend to test it on a separate environment.</p> <p>Migrate existing configs with either the <code class="language-plaintext highlighter-rouge">installto.sh</code> or the <code class="language-plaintext highlighter-rouge">update.sh</code> scripts.</p> <p>And don’t forget to backup your data before installing it!</p> 2026-02-09T00:00:00+00:00 https://roundcube.net/news/2026/02/09/roundcube-1.7-rc3-released <p>We just published the third release candidate for the next major version 1.7 of Roundcube webmail.</p> <p>This release fixes two security issues, and contains a few more fixes for several issues.</p> <p>The security fixes are:</p> <ul> <li>Fix CSS injection vulnerability reported by CERT Polska.</li> <li>Fix remote image blocking bypass via SVG content reported by nullcathedral.</li> </ul> <p>For the full changelog please see <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3">the release page</a>.</p> <p>The tarballs can be downloaded <a href="https://roundcube.net/download/">via roundcube.net</a>.</p> <p>Or directly from <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc3">the release page at github.com</a>.</p> <p>We believe it is production ready, but we recommend to test it on a separate environment.</p> <p>Migrate existing configs with either the <code class="language-plaintext highlighter-rouge">installto.sh</code> or the <code class="language-plaintext highlighter-rouge">update.sh</code> scripts.</p> <p>And don’t forget to backup your data before installing it!</p> 2026-02-08T00:00:00+00:00 https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13 <p>We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities.</p> <h2 id="security-fixes">Security fixes</h2> <ul> <li>Fix CSS injection vulnerability reported by CERT Polska.</li> <li>Fix remote image blocking bypass via SVG content reported by nullcathedral.</li> </ul> <p>See the full changelogs in the release notes on the Github download pages for the updated versions <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.6.13">1.6.13</a> and <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.5.13">1.5.13</a>.</p> <p>We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.</p> 2025-12-15T00:00:00+00:00 https://roundcube.net/news/2025/12/15/roundcube-1.7-rc2-released <p>We just published the second release candidate for the next major version 1.7 of Roundcube webmail.</p> <p>This release fixes two security issues and one syntax error in a database migration file for Postgres databases.</p> <p>The changes are:</p> <ul> <li>Fix Cross-Site-Scripting vulnerability via SVG’s animate tag reported by Valentin T., CrowdStrike.</li> <li>Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.</li> <li>Fix syntax error in DDL scripts for Postgres (#10052)</li> </ul> <p>We believe it is production ready, but we recommend to test it on a separate environment.</p> <p>Migrate existing configs with either the <code class="language-plaintext highlighter-rouge">installto.sh</code> or the <code class="language-plaintext highlighter-rouge">update.sh</code> scripts.</p> <p>And don’t forget to backup your data before installing it!</p> 2025-12-13T00:00:00+00:00 https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12 <p>We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities.</p> <h2 id="security-fixes">Security fixes</h2> <ul> <li>Fix Cross-Site-Scripting vulnerability via SVG’s animate tag reported by Valentin T., CrowdStrike.</li> <li>Fix Information Disclosure vulnerability in the HTML style sanitizer reported by somerandomdev.</li> </ul> <p>See the full changelogs in the release notes on the Github download pages for the updated versions <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.6.12">1.6.12</a> and <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.5.12">1.5.12</a>.</p> <p>We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.</p> 2025-12-10T00:00:00+00:00 https://roundcube.net/news/2025/12/10/roundcube-1.7-rc-released <p>The development team is pleased to announce the release candidate for the next major version 1.7 of Roundcube webmail!</p> <p>With this milestone we introduce a few breaking changes (see below) and some further improvements in comparison to 1.7-beta2.</p> <p>Some noteworthy changes are:</p> <ul> <li>Add scope parameter to contact search (#9863)</li> <li>Add ability to chose from all available contact fields on CSV import (#9419)</li> <li>Add a new plugin called <code class="language-plaintext highlighter-rouge">markdown_editor</code> that provides an alternative editor to compose emails using Markdown syntax.</li> <li>Add rel=’noopener’ to all links opening in a new window to mitigate against misuse in older browsers.</li> </ul> <h4 id="breaking-changes">Breaking Changes</h4> <ul> <li>Remove <code class="language-plaintext highlighter-rouge">contact_search_name</code> option in favor of <code class="language-plaintext highlighter-rouge">contactlist_name_template</code> (#9832)</li> <li>Replace session attribute <code class="language-plaintext highlighter-rouge">changed</code> by <code class="language-plaintext highlighter-rouge">expires_at</code> (to allow for variable session lengths per-user in a future change).</li> <li>Password: Removed the (insecure) virtualmin driver (#8007)</li> </ul> <p>For full details and download links please read the <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc">release notes</a>.</p> <p>We believe it is production ready, but we recommend to test it on a separate environment.</p> <p>Migrate existing configs with either the installto.sh or the update.sh scripts.</p> <p>And don’t forget to backup your data before installing it!</p> 2025-10-01T00:00:00+00:00 https://roundcube.net/news/2025/10/01/roundcube-1.7-beta2-released <p>The development team is pleased to announce the second beta release for the next major version 1.7 of Roundcube webmail.</p> <p>With this milestone we introduce some more fixes, and bring full support for the early version of PHP 8.5.</p> <p>It does not include breaking changes (beyond those of 1.7-beta).</p> <p>Some noteworthy changes are:</p> <ul> <li>Support PHP v8.5(-pre) without deprecation warnings.</li> <li>Support IPv6 in database DSN (#9937)</li> <li>Use <code class="language-plaintext highlighter-rouge">htmleditor</code> setting also for identity signature (#9954)</li> <li>Fix regression in handling of non-unicode characters in a plain text message (#9953)</li> <li>Fix parsing of inline styles that aren’t well-formatted (#9948)</li> <li>Support early MIME types for S/MIME encrypted messages (#9973)</li> <li>Only apply fix_path for href attrib in <link />s (#9943)</li> <li>Show homograph-warning-icon before email address, unify warning wording (#9945)</li> <li>Show full details with warning icon in case of phishing suspicion (#9945)</li> <li>Prepend group-names to display-name (#9945) Thanks to coco_melon for the reporting!</li> <li>Wash the <code class="language-plaintext highlighter-rouge">name</code> attribute also on more elements (#9949) – Thanks to pwn.ai by Octagon Networks for the reporting!</li> <li>Sanitize filename on download (#9960)</li> <li>Drop Internet Explorer from supported browsers (#9963)</li> <li>Enforce leading backslash for non-namespaced non-Roundcube uses (#9935)</li> <li>Use asset_url() instead of get_skin_file() for deleteicon on contact edit form (#9933)</li> <li>Several changes to the test tooling.</li> </ul> <p>For full details please see the <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-beta2">release notes</a>.</p> <p>This is a beta release and we recommend to test it on a separate environment. Migrate existing configs with either the installto.sh or the update.sh scripts.</p> <p>And don’t forget to backup your data before installing it!</p> 2025-07-14T00:00:00+00:00 https://roundcube.net/news/2025/07/14/roundcube-1.7-beta-released <p>The development team is pleased to announce the beta release for the next major version 1.7 of Roundcube webmail.</p> <p>With this milestone we introduce a few breaking changes, some new features, and bring full support for PHP 8.4.</p> <p>Some noteworthy changes are:</p> <ul> <li>Make <code class="language-plaintext highlighter-rouge">public_html/</code> mandatory as entry-point for HTTP daemons, protecting all installations better.</li> <li>Improve support for OAuth2 (e.g. supporting OpenID Connect discovery URLs).</li> <li>A Mouse-over menu on the messages list with quick action icons.</li> <li>Advanced mail search syntax with more possibilities – you can now use e.g. <code class="language-plaintext highlighter-rouge">is:unread</code> to only match unread messages. The <a href="https://github.com/roundcube/roundcubemail/blob/master/tests/Actions/Mail/SearchTest.php#L139">test file</a> has a list of implemented keywords.</li> <li>Message parts of content-type <code class="language-plaintext highlighter-rouge">text/markdown</code> are now rendered to HTML (if they are designated for showing).</li> <li>Add a ‘php’ logging driver, which passes all log statements to PHP’s <code class="language-plaintext highlighter-rouge">error_log</code> handler, allowing to unify all log output.</li> <li>Requires PHP v8.1 or newer.</li> </ul> <h2 id="breaking-changes">Breaking Changes</h2> <ul> <li>Dropped support for PHP &lt; 8.1.</li> <li>Removed support for MS SQL Server and Oracle.</li> <li>Make public_html/ entry-point mandatory, all static resources are served via static.php.</li> <li>Removed <code class="language-plaintext highlighter-rouge">apc</code> cache driver (replaced by <code class="language-plaintext highlighter-rouge">apcu</code> cache driver).</li> <li>Change <code class="language-plaintext highlighter-rouge">smtp_log</code> option default value to <code class="language-plaintext highlighter-rouge">false</code>.</li> </ul> <p>For full details please see the <a href="https://github.com/roundcube/roundcubemail/releases/tag/1.7-beta">release notes</a>.</p> <p>This is a beta release and we recommend to test it on a separate environment. Migrate existing configs with either the <code class="language-plaintext highlighter-rouge">installto.sh</code> or the <code class="language-plaintext highlighter-rouge">update.sh</code> scripts.</p> <p>And don’t forget to backup your data before installing it!</p>