Roundcube has released security updates 1.6.19 and 1.7.4, which address 12 vulnerabilities affecting its 1.6 LTS and 1.7 Webmail branches.
The flaws include a zero-click stored cross-site scripting (XSS) vulnerability, several bypasses of remote content filtering, email header injection bugs, cross-user contact access issues, and a server-side request forgery (SSRF) bypass.
Published on September 6, 2026, the updates address weaknesses in Roundcube’s HTML email rendering, CSS sanitization, attachment handling, address book functionality, and URL validation logic.
Administrators who are running production deployments of Roundcube 1.6.x or 1.7.x are urged to upgrade as soon as possible.
Roundcube Fixes 12 Security Flaws
Among the most significant fixes is a zero-click stored XSS vulnerability involving the injection of a TNEF MIME tag into an attachment URL. Security researcher Nakko reported this issue.
Stored XSS vulnerabilities are particularly concerning in webmail applications because malicious content can persist in a mailbox and be triggered when a victim opens or previews a crafted email.
The zero-click nature of this vulnerability increases the risk, as exploitation does not require recipients to click on a malicious link or download an attachment.
Roundcube also fixed an XSS vulnerability in its HTML editor when processing text/enriched MIME part content, as reported by Joshua Rogers. Both vulnerabilities could expose users to session theft, execution of malicious scripts in the webmail context, or unauthorized actions through an authenticated account.
Several patches address bypasses affecting CSS handling and remote content protections. Roundcube fixed CSS declaration smuggling caused by unencoded ampersand emissions, as reported by Zach Hanley of Horizon3.ai.
Additionally, the update resolves a CSS property injection vulnerability through the HTML body background attribute.
The release also corrects a stylesheet URL validation bypass in the `is_local_url()` function, which allowed a trailing-dot fully qualified domain name (FQDN) to evade local URL checks, a flaw reported by researcher Nept1337.
Additional fixes prevent remote content blockers from being bypassed through CSS escapes in FuncIRI attributes and SVG SMIL src animations.
Remote content filtering is crucial in webmail clients because attacker-controlled remote resources can be used to track when an email is opened, identify a recipient’s IP address, or facilitate targeted phishing activities.
Roundcube patched an SSRF bypass in its CSS proxy that involved hexadecimal IPv6-mapped IPv4 addresses. This issue, reported by Faceless0x7 and Harish Annavisamy, could allow crafted addresses to evade filtering controls intended to restrict server-side requests.
SSRF vulnerabilities can pose significant risks in hosted or enterprise environments, where attackers may attempt to access internal services, cloud metadata endpoints, or other restricted network resources.
Additionally, three email header injection flaws were resolved. These issues involved a bare carriage return in email subject fields, a C-escape \r sequence in recipient display names, and the organization field within a user identity. CVE-Hunter-Leo reported the subject-field issue, while Dogeshark reported the recipient-name and organization-field bugs.
The updates also address a cross-user access vulnerability in contact-group membership operations within the SQL address book. This flaw could allow unauthorized interaction with contact group members across user boundaries, raising privacy and integrity concerns in shared Roundcube deployments.
Roundcube recommends that all organizations update their production installations to version 1.6.19 or 1.7.4. The vendor’s security update announcement provides a complete list of fixes and acknowledges the contributions of the researchers involved.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
