Roundcube 1.7.5 and 1.6.20 fix 20 flaws, including IMAP injection

Roundcube 1.7.5 and 1.6.20 fix 20 flaws, including IMAP injection

19 October 2026: Roundcube has released Webmail 1.7.5 and 1.6.20, the latter on its long-term-support line, with fixes for 20 reported security issues, and says it "strongly" recommends updating every production installation of 1.6.x and 1.7.x. Italy's national cybersecurity agency rates the most serious one, CVE-2026-113386, high: an authenticated remote attacker can run arbitrary IMAP commands.

Not yet independently verified. Roundcube's own notes give no CVE numbers or severity ratings; the one CVE and the "high" rating come from Italy's ACN, and no exploitation has been reported. We will update this when it can be confirmed, and remove this note.

Fixed versions

Line	Affected	Fixed
1.7	before 1.7.5	1.7.5
1.6 (LTS)	before 1.6.20	1.6.20

The project's notes give no CVE numbers or scores. The CVE and the rating come from ACN's alert of 20 October, which reports no proof of concept or exploitation.

What the fixes cover

The issues group into a few kinds:

• Command and header injection: CRLF injection into IMAP commands through the _uid parameter of the headers and view-source actions and the _flag parameter of the mark action, and mail header injection through the From display name in bounces, through References, In-Reply-To and Message-ID, through the subject of a message forwarded as an attachment, and through the media type of an inline image.
• Content filtering: bypasses of remote-content blocking through SVG SMIL and CSS escapes, a CSS scoping bypass using at-rules, and the SSRF filter is_local_url() bypassed through the NAT64 range 64:ff9b::/96.
• Sessions and access: an object-injection primitive in rcube_session::unserialize(), alias logins not qualified by IMAP host, deprecated action aliases that bypassed the disabled_actions setting, and a CSRF check bypass in mark-as-junk.
• Plugins and media: the Modoboa password driver could change another account's password, an XSS in password driver error handling, an unsafe login name in the SquirrelMail import path, and image handling that passed unsafe content to ImageMagick or bypassed its limits through the GD fallback.

Where Roundcube runs

Roundcube is the webmail front end shipped by many hosting control panels and self-managed mail stacks, which is why its releases are often applied by the hosting provider rather than the customer. Organisations that run their own mail server should check which version their panel or package repository actually delivers, and anyone using the password plugin with the Modoboa driver should treat that fix as urgent. Webmail has been a regular target for state-backed and criminal groups because one session gives access to a whole mailbox.

Sources

• Roundcube: Security updates 1.6.20 and 1.7.5 released, 19 October 2026
• Roundcube on GitHub: release 1.7.5, 19 October 2026
• ACN (Italy): Risolta vulnerabilità in Roundcube Webmail (AL02/261020/CSIRT-ITA), 20 October 2026