Roundcube 1.6.21 and 1.7.6 fix 17 security flaws, including Sieve and IMAP injection and SSRF/CSRF bypasses
On 9 November 2026 the Roundcube Project released Roundcube Webmail 1.6.21 (LTS branch) and 1.7.6 (mainline) to fix 17 security issues, most of them reported by named researchers (roundcube.net). The vendor published no CVE IDs for this batch, and linuxcompatible.org reports that CVE numbers had not yet been assigned at release (linuxcompatible.org). The vendor gives no CVSS score and does not state that any of the flaws are exploited in the wild (roundcube.net). Several fixes depend on a logged-in user or a crafted message, and the vendor does not spell out the prerequisites for each one, so the real exposure is limited but not negligible. The project strongly urges all production installations of 1.6.x and 1.7.x to be updated, and it warns that the 1.6 branch will be discontinued soon (roundcube.net).
Entenda a falha
A vulnerabilidade
Roundcube Webmail 1.6.20 and earlier and 1.7.5 and earlier contain 17 security flaws, fixed in 1.6.21 (LTS) and 1.7.6. No CVE IDs had been assigned at release, and the vendor gives no CVSS scores. The flaws include injection of Sieve scripts, mail headers, HTTP requests and IMAP commands, two SSRF filter bypasses, three CSRF bypasses, and a disabled_actions bypass. The batch also has an open redirect, an unbounded CPU loop (denial of service) and unsafe attachment data passed to ImageMagick. Several need a logged-in user or a crafted message, but the vendor does not list the prerequisites for each one. No in-the-wild exploitation is reported.
Como funciona
In the injection cases, attacker-influenced input such as a rule operator, a set/include modifier, an MDN subject, a spellcheck request or the _uid parameter reaches Roundcube, which builds a Sieve script, a mail header, an HTTP request or an IMAP command from it. Special characters, for example CRLF in _uid when messages_cache is enabled, change the structure of what is sent downstream. For SSRF, the server-side URL filter or the CSS proxy accepts certain addresses and hostnames (6to4 addresses, nip.io and sslip.io names) that resolve to internal targets. In the CSRF cases, requests such as purge, expunge or managesieve actions via GET are accepted without the proper cross-site validation.
Por que é vulnerável
The articles point to missing or incomplete input validation and request checks. Untrusted values are not sanitized before being embedded in Sieve, headers, HTTP or IMAP commands. The SSRF and CSRF filters do not cover every variant. The disabled_actions check can be evaded by writing an underscore instead of a hyphen in the action name. rcube_session::unserialize() does not handle a negative length token, which causes an unbounded loop. The fixes in 1.6.21 and 1.7.6 close these gaps; the articles give no further detail on why they went unnoticed.
Onde está
The articles name is_local_url() (SSRF filter), rcube_session::unserialize() (CPU loop), resolve_url() (trusted host setting), the _uid parameter with messages_cache, the disabled_actions setting and the CSS proxy; fixes are in the roundcube/roundcubemail repository and the roundcube.net announcement.
Como foi descoberta
According to the story, most of the 17 issues were reported by named researchers (credited on roundcube.net; the articles do not list the names). The Roundcube Project disclosed them through its release announcement on 9 November 2026. The vendor does not say any were exploited in the wild, and linuxcompatible.org reports that CVE IDs had not yet been assigned.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:17.
Detalhes técnicos
- Injection: Sieve script injection through rule operators and set/include modifiers, mail header injection through an MDN subject, HTTP request injection through the spellcheck ATD backend, and IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled (roundcube.net, github.com/roundcube/roundcubemail).
- SSRF: a bypass of the is_local_url() filter through 6to4 (2002::/16) addresses, and an SSRF in the CSS proxy through nip.io and sslip.io hostnames (roundcube.net).
- CSRF and access control: a CSRF validation bypass for file-only POST requests, a CSRF bypass for mail purge and expunge commands, managesieve destructive actions that could be triggered cross-site via GET, and a disabled_actions bypass by writing an underscore instead of a hyphen in the action name (roundcube.net).
- Other: an open redirect in IMAP error recovery on attachment get, a Received: header that could include untrusted hostnames, resolve_url() ignoring the trusted host setting, unsafe attachment content passed to ImageMagick during image type conversion, and an unbounded CPU loop in rcube_session::unserialize() that can be triggered with a negative length token (roundcube.net, github.com/roundcube/roundcubemail).
Remediação
Update production servers to 1.7.6 or to 1.6.21, which are published on the official download page (roundcube.net/download, github.com/roundcube/roundcubemail). Installations on the 1.6 branch should plan a move to 1.7, because the project states that 1.6 will be discontinued and that backporting fixes has become time consuming and error prone (roundcube.net). The article's claim that CISA's KEV catalog lists 11 older Roundcube flaws was not verified during this research.
Linha do tempo
-
Roundcube 1.6.21 and 1.7.6 fix 17 security flaws, including Sieve and IMAP injection and SSRF/CSRF bypasses
ler a análise desta fonte ocultar
On 9 November 2026 the Roundcube Project released Roundcube Webmail 1.6.21 (LTS branch) and 1.7.6 (mainline) to fix 17 security issues, most of them reported by named researchers (roundcube.net). The vendor published no CVE IDs for this batch, and linuxcompatible.org reports that CVE numbers had not yet been assigned at release (linuxcompatible.org). The vendor gives no CVSS score and does not state that any of the flaws are exploited in the wild (roundcube.net). Several fixes depend on a logged-in user or a crafted message, and the vendor does not spell out the prerequisites for each one, so the real exposure is limited but not negligible. The project strongly urges all production installations of 1.6.x and 1.7.x to be updated, and it warns that the 1.6 branch will be discontinued soon (roundcube.net).
Technical Details
- Injection: Sieve script injection through rule operators and set/include modifiers, mail header injection through an MDN subject, HTTP request injection through the spellcheck ATD backend, and IMAP command injection through CRLF in the _uid parameter when messages_cache is enabled (roundcube.net, github.com/roundcube/roundcubemail).
- SSRF: a bypass of the is_local_url() filter through 6to4 (2002::/16) addresses, and an SSRF in the CSS proxy through nip.io and sslip.io hostnames (roundcube.net).
- CSRF and access control: a CSRF validation bypass for file-only POST requests, a CSRF bypass for mail purge and expunge commands, managesieve destructive actions that could be triggered cross-site via GET, and a disabled_actions bypass by writing an underscore instead of a hyphen in the action name (roundcube.net).
- Other: an open redirect in IMAP error recovery on attachment get, a Received: header that could include untrusted hostnames, resolve_url() ignoring the trusted host setting, unsafe attachment content passed to ImageMagick during image type conversion, and an unbounded CPU loop in rcube_session::unserialize() that can be triggered with a negative length token (roundcube.net, github.com/roundcube/roundcubemail).
Remediation
Update production servers to 1.7.6 or to 1.6.21, which are published on the official download page (roundcube.net/download, github.com/roundcube/roundcubemail). Installations on the 1.6 branch should plan a move to 1.7, because the project states that 1.6 will be discontinued and that backporting fixes has become time consuming and error prone (roundcube.net). The article's claim that CISA's KEV catalog lists 11 older Roundcube flaws was not verified during this research.