Roundcube Webmail: multiple flaws (SSRF, CSRF bypass, injection, DoS) fixed in 1.6.21 and 1.7.6
Roundcube published security updates 1.6.21 and 1.7.6 for Roundcube Webmail on 9 November 2026, fixing 17 flaws reported by external researchers (roundcube.net). The fixes cover server-side request forgery, CSRF validation bypasses, header and IMAP command injection, Sieve script injection, a denial of service in session parsing, an open redirect and an unsafe hand-off of attachment content to ImageMagick (roundcube.net). Neither the vendor bulletin nor its release notes assign CVE identifiers or CVSS scores, and the sources opened do not report exploitation in the wild. Several items are CSRF bypasses that need a victim's browser to submit a request, which limits their reach. Urgency is rated high because the vendor strongly recommends updating every productive 1.6.x and 1.7.x installation and webmail services are often internet-facing.
Entenda a falha
A vulnerabilidade
Roundcube Webmail 1.6.x before 1.6.21 and 1.7.x before 1.7.6 have 17 flaws, none with a CVE ID or CVSS score. They include SSRF in the CSS proxy (nip.io, sslip.io and 6to4 addresses get past the local-URL filter), CSRF validation bypasses (file-only POSTs, mail purge/expunge, managesieve actions via GET, and a disabled_actions bypass), and Sieve, mail header, spellcheck HTTP and IMAP command injection. They also include a CPU-exhaustion DoS in session parsing, an open redirect and unsafe attachment content passed to ImageMagick. CSRF items need a victim's browser to submit a request. Fixed in 1.6.21 and 1.7.6. The vendor names no remote code execution flaw, but CERT-FR says some flaws allow arbitrary code execution.
Como funciona
In the SSRF case, a URL sent to the CSS proxy is checked by is_local_url() to keep the server from fetching internal addresses. Hostnames such as nip.io or sslip.io, or 6to4 addresses, resolve to internal targets but are not recognised as local, so the server makes the request. In the injection cases, user-controlled values such as a Sieve rule operator, an MDN subject or the _uid parameter are placed into scripts, headers or IMAP commands without neutralising special characters like CRLF. In the DoS case, rcube_session::unserialize() reads a length token, and a negative value sends it into a loop with no bound on CPU time.
Por que é vulnerável
The flaws share a pattern of missing or incomplete validation. The local-URL blocklist did not cover all ways to name an internal host. CSRF checks skipped some request types and let actions through via GET. The disabled_actions check could be dodged by writing an underscore instead of a hyphen in the action name. Input was not sanitised before reaching Sieve, headers or IMAP, and the session parser did not validate length tokens. The fixes tighten these checks, add stricter IMAP host validation and limit the Received header to a trusted hostname and a forwarded IP from a trusted proxy. The articles do not say why they went unnoticed.
Onde está
The release notes name is_local_url() (CSS proxy), rcube_session::unserialize(), resolve_url(), the disabled_actions setting and the messages_cache option; the full changelogs are on the roundcube/roundcubemail GitHub release pages.
Como foi descoberta
According to the vendor, the 17 flaws were reported by external researchers; the articles name no one and do not describe how they were found. Roundcube disclosed them on 9 November 2026 in a security update bulletin with releases 1.6.21 and 1.7.6, and CERT-FR issued an advisory the next day. The sources report no exploitation in the wild.
Explicação gerada por IA a partir da matéria e dos artigos, em 10/11/2026 13:35.
Detalhes técnicos
The vendor's release notes group the fixes as follows (roundcube.net, github.com/roundcube/roundcubemail):
- SSRF: an incomplete
is_local_url()check in the CSS proxy that did not block nip.io and sslip.io hostnames, and a separate bypass of the same filter through 6to4 (2002::/16) addresses. - CSRF: validation bypass for file-only POST requests; validation bypass for mail purge and expunge commands; managesieve destructive actions reachable cross-site via GET; and a
disabled_actionsrestriction bypass by writing an underscore instead of a hyphen in the action name. - Injection: Sieve script injection through a rule operator and through set/include modifiers; mail header injection through an MDN subject; HTTP request injection through the spellcheck ATD backend; IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled.
- Denial of service: an unbounded CPU loop in
rcube_session::unserialize()triggered by a negative length token. - Other: open redirect through IMAP error recovery on attachment get; Received header limited to a trusted hostname and forwarded IP from a trusted proxy;
resolve_url()ignoring the trusted host setting; potentially unsafe attachment content passed to ImageMagick on image type conversion; stricter validation of the IMAP host input.
The affected versions are 1.6.x before 1.6.21 and 1.7.x before 1.7.6 (roundcube.net). The vendor does not label any item as remote code execution. The ImageMagick item is the closest to it.
Remediação
Update to Roundcube Webmail 1.6.21 for the 1.6 LTS branch or to 1.7.6 for the 1.7 branch, the versions the vendor names as fixed (roundcube.net). The tagged release pages on GitHub carry the full changelogs (github.com/roundcube/roundcubemail). Operators still on 1.6 should plan a move to 1.7, because the vendor says the 1.6 branch will be discontinued soon and that backporting has become error-prone (roundcube.net). The sources opened publish no indicators of compromise.
Relatos divergentes
The article says some of the flaws allow arbitrary code execution. The vendor bulletin names no remote code execution flaw and describes injection, SSRF, CSRF, denial-of-service and open redirect issues instead (roundcube.net). The vendor's wording is used in this record.
Linha do tempo
-
Roundcube Webmail: multiple flaws (SSRF, CSRF bypass, injection, DoS) fixed in 1.6.21 and 1.7.6
ler a análise desta fonte ocultar
Roundcube published security updates 1.6.21 and 1.7.6 for Roundcube Webmail on 9 November 2026, fixing 17 flaws reported by external researchers (roundcube.net). The fixes cover server-side request forgery, CSRF validation bypasses, header and IMAP command injection, Sieve script injection, a denial of service in session parsing, an open redirect and an unsafe hand-off of attachment content to ImageMagick (roundcube.net). Neither the vendor bulletin nor its release notes assign CVE identifiers or CVSS scores, and the sources opened do not report exploitation in the wild. Several items are CSRF bypasses that need a victim's browser to submit a request, which limits their reach. Urgency is rated high because the vendor strongly recommends updating every productive 1.6.x and 1.7.x installation and webmail services are often internet-facing.
Technical Details
The vendor's release notes group the fixes as follows (roundcube.net, github.com/roundcube/roundcubemail):
- SSRF: an incomplete
is_local_url()check in the CSS proxy that did not block nip.io and sslip.io hostnames, and a separate bypass of the same filter through 6to4 (2002::/16) addresses. - CSRF: validation bypass for file-only POST requests; validation bypass for mail purge and expunge commands; managesieve destructive actions reachable cross-site via GET; and a
disabled_actionsrestriction bypass by writing an underscore instead of a hyphen in the action name. - Injection: Sieve script injection through a rule operator and through set/include modifiers; mail header injection through an MDN subject; HTTP request injection through the spellcheck ATD backend; IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled.
- Denial of service: an unbounded CPU loop in
rcube_session::unserialize()triggered by a negative length token. - Other: open redirect through IMAP error recovery on attachment get; Received header limited to a trusted hostname and forwarded IP from a trusted proxy;
resolve_url()ignoring the trusted host setting; potentially unsafe attachment content passed to ImageMagick on image type conversion; stricter validation of the IMAP host input.
The affected versions are 1.6.x before 1.6.21 and 1.7.x before 1.7.6 (roundcube.net). The vendor does not label any item as remote code execution. The ImageMagick item is the closest to it.
Remediation
Update to Roundcube Webmail 1.6.21 for the 1.6 LTS branch or to 1.7.6 for the 1.7 branch, the versions the vendor names as fixed (roundcube.net). The tagged release pages on GitHub carry the full changelogs (github.com/roundcube/roundcubemail). Operators still on 1.6 should plan a move to 1.7, because the vendor says the 1.6 branch will be discontinued soon and that backporting has become error-prone (roundcube.net). The sources opened publish no indicators of compromise.
Conflicting Reports
The article says some of the flaws allow arbitrary code execution. The vendor bulletin names no remote code execution flaw and describes injection, SSRF, CSRF, denial-of-service and open redirect issues instead (roundcube.net). The vendor's wording is used in this record.
- SSRF: an incomplete