Roundcube released versions 1.6.20 and 1.7.5 on 19 October 2026 with about twenty security fixes, and Debian shipped them for Debian 13 (trixie) on 23 October in DSA-6579-1. Debian lists possible IMAP command injection, cross-site scripting, SSRF bypass, email header injection, CSS property injection, remote content blocking bypass, information disclosure and privilege escalation.
Debian 12 (bookworm) received the two previous Roundcube rounds through the LTS team, but as of 31 October 2026 the security tracker still lists it as vulnerable to all 20 CVEs in this one. Webmail deserves quick patching: CISA's Known Exploited Vulnerabilities catalog includes several older Roundcube flaws, most recently CVE-2025-49113 and CVE-2025-68461, added on 20 February 2026.
At a glance
| Item | Details |
|---|---|
| Source package | roundcube (binaries roundcube-core, roundcube-plugins, roundcube-mysql / roundcube-pgsql / roundcube-sqlite3, roundcube) |
| Debian 13 (trixie) | Fixed in 1.6.20+dfsg-0+deb13u1 (DSA-6579-1) |
| Debian 12 (bookworm) | Latest is 1.6.5+dfsg-1+deb12u12 (DLA-4823-1); still vulnerable to the DSA-6579-1 CVEs |
| Earlier rounds | August: DSA-6479-1 / DLA-4760-1. September: DSA-6545-1 / DLA-4823-1. |
| Severity | High (CNA CVSS up to 8.5; Roundcube does not publish ratings) |
What the vulnerabilities are
Most of these issues need a logged-in user or a crafted email. The higher-scored ones:
- CVE-2026-114716 (CVSS 8.5): a logged-in attacker can put CRLF sequences in the media type of an inline image and inject MIME headers into outgoing mail.
- CVE-2026-114727 (8.3): SVG and EPS were accepted for contact photos and handed to ImageMagick, and both formats can reference external resources and invoke ImageMagick delegates. The fix removes those types.
- CVE-2026-114724 (7.4): a session-handling bug gives a PHP object injection primitive to an attacker who can influence stored session data.
- CVE-2026-114730 (7.2): the SSRF filter missed NAT64 prefixes, so crafted URLs could reach loopback, link-local or cloud metadata addresses. This affects 1.6.14 and later.
- CVE-2026-113386 and CVE-2026-114720 (7.1): IMAP command injection through CRLF in the
_uidand_flagrequest parameters.
The rest include further header-injection paths, an XSS in password-plugin error messages, a Modoboa password-driver bug that could change another account's password (CVE-2026-114715), a path traversal in the squirrelmail_usercopy plugin, a CSRF bypass in markasjunk, a disabled_actions bypass, remote-content-blocking bypasses, and an alias-login issue on multi-host setups. None of the 20 is in the KEV catalog (30 October 2026 edition).
Are you affected?
dpkg-query -W -f='${Package} ${Version}\n' 'roundcube*'
apt policy roundcube-core
sudo grep -rn plugins /etc/roundcube/*.phpTrixie below 1.6.20+dfsg-0+deb13u1 is affected. On bookworm, make sure you have at least 1.6.5+dfsg-1+deb12u12, which covers the August (DLA-4760-1) and September (DLA-4823-1) rounds. The last command shows which plugins are enabled; several of the issues sit in optional plugins.
How to update
sudo apt update
sudo apt install --only-upgrade roundcube roundcube-core roundcube-plugins roundcube-mysql roundcube-pgsql roundcube-sqlite3
apt policy roundcube-coreOn bookworm, until a DLA for the 1.6.20 fixes appears on the roundcube tracker page:
- Disable plugins you do not use, especially
password(if it uses the Modoboa driver),squirrelmail_usercopyandmarkasjunk. - Keep webmail behind HTTPS, and consider limiting it to your own networks or a VPN if your users allow it.
- Plan the move to trixie, which already has these fixes.
Restart or reboot?
No reboot. Roundcube is PHP code, so reload the service that runs it to make sure no old code stays cached, then log in and send a test message:
sudo systemctl reload apache2
# or, with PHP-FPM, for example on trixie:
sudo systemctl restart php8.4-fpmSources
- security-tracker.debian.org/tracker/DSA-6579-1
- debian.org/security/2026/dsa-6579
- lists.debian.org/debian-security-announce/2026/msg00495.html
- security-tracker.debian.org/tracker/DLA-4823-1
- lists.debian.org/debian-lts-announce/2026/10/msg00015.html
- security-tracker.debian.org/tracker/DLA-4760-1
- lists.debian.org/debian-lts-announce/2026/08/msg00051.html
- security-tracker.debian.org/tracker/DSA-6545-1
- security-tracker.debian.org/tracker/DSA-6479-1
- security-tracker.debian.org/tracker/source-package/roundcube
- security-tracker.debian.org/tracker/CVE-2026-113386
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
- roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4
- roundcube.net/news/2026/08/09/security-updates-1.6.18-and-1.7.3
- cve.org/CVERecord?id=CVE-2026-114716
- cve.org/CVERecord?id=CVE-2026-114727
- cve.org/CVERecord?id=CVE-2025-49113
- cisa.gov/known-exploited-vulnerabilities-catalog
- packages.debian.org/source/trixie/roundcube
Comments
0 total · 0 threads