LoginSign Up
← Back to all sparks
R

Roundcube

COMMS
Velocity5.0

Browser-based IMAP webmail client with a desktop-like interface

roundcube.net ↗

Roundcube patches its Sieve filters and CSRF checks in a sixth paired security release

webmailsecuritylts-maintenancesieveopen-source
◆Current state
Roundcube shipped 1.7.6 and 1.6.21 on 9 November, three weeks after 1.7.5 and 1.6.20, again as an identical security pair. This round centres on the managesieve filter plugin (two script-injection paths and destructive actions triggerable cross-site via GET), plus CSRF bypasses, an open redirect, an SSRF bypass via nip.io and sslip.io hostnames and a disabled_actions bypass.
◆Where it's heading
Security releases now arrive every three to five weeks, each with a dozen or more externally reported fixes, and the same research group is behind many of them. The project is in a sustained audit phase, and both branches move together every time.
◆Prediction
Another paired 1.7.x and 1.6.x security release within about a month is the most likely next entry, given the cadence since June.

◆Recent moves

  1. 4d ago

    Roundcube Webmail 1.7.6

    The sixth paired security release since June, focused on Sieve script injection, cross-site triggering of managesieve actions and CSRF bypasses. Admins running the managesieve plugin have the most reason to upgrade quickly.

    View source ↗
  2. 4d ago

    Roundcube Webmail 1.6.21

    The LTS branch receives the same fix set as 1.7.6, including the Sieve injections and the SSRF bypass through wildcard DNS hostnames. Parity between branches holds again.

    View source ↗
  3. 26d ago

    Roundcube Webmail 1.7.5

    Fixes 13 reported issues including IMAP command injection through the _uid parameter, header injection in bounce and reply fields, a session unserialize object-injection primitive and an SSRF filter bypass via NAT64. Same-day parity with 1.6.20, as in every release since June.

    View source ↗
  4. 26d ago

    Roundcube Webmail 1.6.20

    The LTS branch gets the identical 13-fix security set as 1.7.5, including the IMAP injection and session object-injection fixes. Keeps the two lines in lockstep.

    View source ↗
  5. 2mo ago

    Roundcube Webmail 1.7.4

    Version 1.7.4 patches 12 vulnerabilities reported by external researchers, including CSS declaration smuggling, three email header injection vectors, a zero-click stored XSS via TNEF MIME tags, and an SSRF bypass using hexadecimal IPv6-mapped IPv4 addresses. The breadth continues the pattern of coordinated researcher disclosure against Roundcube's HTML and CSS handling.

    View source ↗
  6. 2mo ago

    Roundcube Webmail 1.6.19

    Version 1.6.19 applies the same 12-vulnerability patch set to the LTS branch, maintaining parity with 1.7.4. The consistent dual-branch release pattern ensures installations that cannot migrate to 1.7.x still receive critical security fixes.

    View source ↗