EN PT-BR
← Voltar ao feed
high

Roundcube Webmail 1.6.21 and 1.7.6 fix 17 flaws: Sieve/IMAP injection, SSRF, CSRF bypasses, DoS

2 fonte(s) · 2 atualização(ões) · publicado 09/11/2026 11:49 · coletado há 11 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 2 fontes trouxeram em 11/11/2026 00:00; os links antigos trazem para cá.

Fontes: cert.cyber.gouv.fr ↗ securityonline.info ↗

On 9 November 2026 the Roundcube Project released Roundcube Webmail 1.6.21 (LTS branch) and 1.7.6 (mainline) to fix 17 security issues, most reported by external researchers (roundcube.net, securityonline.info, cert.cyber.gouv.fr). The vendor assigned no CVE IDs and gave no CVSS scores, and linuxcompatible.org reports that CVE numbers had not yet been assigned at release. None of the sources reports exploitation in the wild. Affected versions are 1.6.x before 1.6.21 and 1.7.x before 1.7.6 (cert.cyber.gouv.fr). Several fixes need a logged-in user, a crafted message or a victim's browser, which limits exposure. cert.cyber.gouv.fr nonetheless rates urgency as high because webmail is often internet-facing and the vendor strongly urges updating all production 1.6.x and 1.7.x installations. The vendor also warns that the 1.6 branch will be discontinued soon.

Entenda a falha

A vulnerabilidade

Roundcube Webmail 1.6.x before 1.6.21 and 1.7.x before 1.7.6 (so 1.6.20 and 1.7.5 and earlier) have 17 flaws. None has a CVE ID or CVSS score yet. They include SSRF filter bypasses (6to4 addresses, nip.io and sslip.io in the CSS proxy), CSRF and access-control bypasses (including managesieve actions via GET and a disabled_actions bypass), and Sieve, mail header, spellcheck HTTP and IMAP command injection. They also include a CPU-exhaustion DoS in session parsing, an open redirect and unsafe attachment data passed to ImageMagick. Several need a logged-in user, a crafted message or a victim's browser. Fixed in 1.6.21 and 1.7.6. The vendor labels no item as RCE, but CERT-FR lists arbitrary code execution among the impacts; that is unconfirmed.

Como funciona

In the SSRF case, a URL sent to the CSS proxy is checked by is_local_url() so the server does not fetch internal addresses. Names under nip.io or sslip.io, or 6to4 addresses, can point at internal targets without being recognised as local, so the server makes the request. In the injection cases, user-controlled values (a Sieve rule operator, set/include modifiers, an MDN subject, the _uid parameter with messages_cache enabled) are placed into scripts, headers or IMAP commands without neutralising special characters such as CRLF. In the DoS case, rcube_session::unserialize() reads a length token, and a negative value sends it into a loop with no bound.

Por que é vulnerável

The flaws share a pattern of missing or incomplete validation. The local-URL blocklist did not cover every way to name an internal host. CSRF checks skipped some request types and let destructive actions through via GET. The disabled_actions check could be dodged by writing an underscore instead of a hyphen. Input was not sanitised before reaching Sieve, headers or IMAP, and the session parser did not validate length tokens. The fixes tighten these checks, validate the IMAP host input more strictly and limit the Received header to a trusted hostname and a forwarded IP from a trusted proxy. The articles do not say why the flaws went unnoticed.

Onde está

The release notes name is_local_url() (CSS proxy), rcube_session::unserialize(), resolve_url(), the disabled_actions setting and the messages_cache option; full changelogs are on the roundcube/roundcubemail GitHub release pages.

Como foi descoberta

According to the vendor, most of the 17 flaws were reported by external researchers; the articles name no one and do not describe how they were found. Roundcube disclosed them on 9 November 2026 in a security update bulletin with releases 1.6.21 and 1.7.6, and CERT-FR issued advisory CERTFR-2026-AVI-1489 on 10 November. No source reports exploitation in the wild, and CVE IDs had not been assigned at release.

Explicação gerada por IA a partir da matéria e dos artigos, em 11/11/2026 00:15.

Detalhes técnicos

  • SSRF: a bypass of the is_local_url() filter through 6to4 (2002::/16) addresses, and an incomplete check in the CSS proxy that did not block nip.io and sslip.io hostnames (roundcube.net, cert.cyber.gouv.fr).
  • CSRF and access control: a validation bypass for file-only POST requests; a bypass for mail purge and expunge commands; managesieve destructive actions reachable cross-site via GET; and a disabled_actions bypass by writing an underscore instead of a hyphen in the action name (roundcube.net).
  • Injection: Sieve script injection through a rule operator and through set/include modifiers; mail header injection through an MDN subject; HTTP request injection through the spellcheck ATD backend; and IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled (roundcube.net, github.com/roundcube/roundcubemail).
  • Denial of service: an unbounded CPU loop in rcube_session::unserialize() triggered by a negative length token (roundcube.net, cert.cyber.gouv.fr).
  • Other: an open redirect in IMAP error recovery on attachment get; the Received header is now limited to a trusted hostname and a forwarded IP from a trusted proxy (securityonline.info described it as possibly including untrusted hostnames); resolve_url() ignoring the trusted host setting; potentially unsafe attachment content passed to ImageMagick during image type conversion; and stricter validation of the IMAP host input (cert.cyber.gouv.fr).
  • The vendor does not label any item as remote code execution. The ImageMagick item is the closest to it (cert.cyber.gouv.fr). No indicators of compromise are published.

Remediação

Update to 1.7.6 or, on the LTS branch, 1.6.21, both available from the official download page and the tagged GitHub releases, which carry the full changelogs (roundcube.net, github.com/roundcube/roundcubemail). Operators on 1.6 should plan a move to 1.7, because the vendor says 1.6 will be discontinued and that backporting fixes has become time consuming and error prone (roundcube.net).

Relatos divergentes

  • Code execution: cert.cyber.gouv.fr notes that an article claims some of the flaws allow arbitrary code execution, but the vendor does not classify any item as RCE. The vendor's release notes are the more authoritative source. The excerpt of that claim is truncated in the input, so it is unconfirmed.
  • CISA KEV: securityonline.info says an article's claim that CISA's KEV catalog lists 11 older Roundcube flaws was not verified. It is unconfirmed and unrelated to these 17 fixes.
  • CVE IDs: no source lists CVE IDs. linuxcompatible.org says they had not yet been assigned at release, so they may appear later.

Linha do tempo

  1. cert.cyber.gouv.fr ↗ · pub. 09/11/2026 21:00 · coletado 10/11 13:04

    Roundcube Webmail: multiple flaws (SSRF, CSRF bypass, injection, DoS) fixed in 1.6.21 and 1.7.6

    ler a análise desta fonte

    Roundcube published security updates 1.6.21 and 1.7.6 for Roundcube Webmail on 9 November 2026, fixing 17 flaws reported by external researchers (roundcube.net). The fixes cover server-side request forgery, CSRF validation bypasses, header and IMAP command injection, Sieve script injection, a denial of service in session parsing, an open redirect and an unsafe hand-off of attachment content to ImageMagick (roundcube.net). Neither the vendor bulletin nor its release notes assign CVE identifiers or CVSS scores, and the sources opened do not report exploitation in the wild. Several items are CSRF bypasses that need a victim's browser to submit a request, which limits their reach. Urgency is rated high because the vendor strongly recommends updating every productive 1.6.x and 1.7.x installation and webmail services are often internet-facing.

    Technical Details

    The vendor's release notes group the fixes as follows (roundcube.net, github.com/roundcube/roundcubemail):

    • SSRF: an incomplete is_local_url() check in the CSS proxy that did not block nip.io and sslip.io hostnames, and a separate bypass of the same filter through 6to4 (2002::/16) addresses.
    • CSRF: validation bypass for file-only POST requests; validation bypass for mail purge and expunge commands; managesieve destructive actions reachable cross-site via GET; and a disabled_actions restriction bypass by writing an underscore instead of a hyphen in the action name.
    • Injection: Sieve script injection through a rule operator and through set/include modifiers; mail header injection through an MDN subject; HTTP request injection through the spellcheck ATD backend; IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled.
    • Denial of service: an unbounded CPU loop in rcube_session::unserialize() triggered by a negative length token.
    • Other: open redirect through IMAP error recovery on attachment get; Received header limited to a trusted hostname and forwarded IP from a trusted proxy; resolve_url() ignoring the trusted host setting; potentially unsafe attachment content passed to ImageMagick on image type conversion; stricter validation of the IMAP host input.

    The affected versions are 1.6.x before 1.6.21 and 1.7.x before 1.7.6 (roundcube.net). The vendor does not label any item as remote code execution. The ImageMagick item is the closest to it.

    Remediation

    Update to Roundcube Webmail 1.6.21 for the 1.6 LTS branch or to 1.7.6 for the 1.7 branch, the versions the vendor names as fixed (roundcube.net). The tagged release pages on GitHub carry the full changelogs (github.com/roundcube/roundcubemail). Operators still on 1.6 should plan a move to 1.7, because the vendor says the 1.6 branch will be discontinued soon and that backporting has become error-prone (roundcube.net). The sources opened publish no indicators of compromise.

    Conflicting Reports

    The article says some of the flaws allow arbitrary code execution. The vendor bulletin names no remote code execution flaw and describes injection, SSRF, CSRF, denial-of-service and open redirect issues instead (roundcube.net). The vendor's wording is used in this record.

  2. securityonline.info ↗ · pub. 09/11/2026 11:49 · coletado 09/11 12:00 primeiro registro

    Roundcube 1.6.21 and 1.7.6 fix 17 security flaws, including Sieve and IMAP injection and SSRF/CSRF bypasses

    ler a análise desta fonte

    On 9 November 2026 the Roundcube Project released Roundcube Webmail 1.6.21 (LTS branch) and 1.7.6 (mainline) to fix 17 security issues, most of them reported by named researchers (roundcube.net). The vendor published no CVE IDs for this batch, and linuxcompatible.org reports that CVE numbers had not yet been assigned at release (linuxcompatible.org). The vendor gives no CVSS score and does not state that any of the flaws are exploited in the wild (roundcube.net). Several fixes depend on a logged-in user or a crafted message, and the vendor does not spell out the prerequisites for each one, so the real exposure is limited but not negligible. The project strongly urges all production installations of 1.6.x and 1.7.x to be updated, and it warns that the 1.6 branch will be discontinued soon (roundcube.net).

    Technical Details

    • Injection: Sieve script injection through rule operators and set/include modifiers, mail header injection through an MDN subject, HTTP request injection through the spellcheck ATD backend, and IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled (roundcube.net, github.com/roundcube/roundcubemail).
    • SSRF: a bypass of the is_local_url() filter through 6to4 (2002::/16) addresses, and an SSRF in the CSS proxy through nip.io and sslip.io hostnames (roundcube.net).
    • CSRF and access control: a CSRF validation bypass for file-only POST requests, a CSRF bypass for mail purge and expunge commands, managesieve destructive actions that could be triggered cross-site via GET, and a disabled_actions bypass by writing an underscore instead of a hyphen in the action name (roundcube.net).
    • Other: an open redirect in IMAP error recovery on attachment get, a Received: header that could include untrusted hostnames, resolve_url() ignoring the trusted host setting, unsafe attachment content passed to ImageMagick during image type conversion, and an unbounded CPU loop in rcube_session::unserialize() that can be triggered with a negative length token (roundcube.net, github.com/roundcube/roundcubemail).

    Remediation

    Update production servers to 1.7.6 or to 1.6.21, which are published on the official download page (roundcube.net/download, github.com/roundcube/roundcubemail). Installations on the 1.6 branch should plan a move to 1.7, because the project states that 1.6 will be discontinued and that backporting fixes has become time consuming and error prone (roundcube.net). The article's claim that CISA's KEV catalog lists 11 older Roundcube flaws was not verified during this research.