Loading story…
Roundcube Webmail has released urgent security updates to address two critical vulnerabilities affecting versions 1.6 and 1.5 LTS. The first flaw is a Cross-Site Scripting (XSS) vulnerability in the SVG handling mechanism, which allows attackers to inject and execute arbitrary JavaScript code via the animate tag, potentially leading to the theft of session tokens, credentials, and sensitive email data. The second vulnerability is an information disclosure issue in the HTML style sanitizer, enabling attackers to bypass sanitization filters and access confidential information through specially crafted HTML content. Both vulnerabilities were reported by independent security researchers and pose significant risks to user privacy and data security.
Roundcube has released patched versions 1.6.12 and 1.5.12 to mitigate these threats and strongly recommends immediate updates for all affected installations. System administrators are urged to verify their current Roundcube version and apply the updates without delay, as exploitation in the wild is possible. The security community highlights the importance of prompt patching to prevent unauthorized access and information leakage in webmail environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Roundcube published security updates for supported branches to fix the SVG XSS and CSS sanitizer flaws. Administrators were advised to upgrade immediately because the vulnerabilities posed a high risk and may have been exploitable in the wild.
Two security flaws affecting Roundcube Webmail were disclosed: an XSS issue in SVG handling and an information disclosure issue in the HTML/CSS style sanitizer. The bugs could allow malicious script execution, theft of session data or credentials, and exposure of sensitive email information.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions **1.6.16** and **1.7.1**, following earlier fixes in **1.6.14** for the 1.6.x line. The newly disclosed issues include **CVE-2026-48842**, a pre-authentication SQL injection flaw in the `virtuser_query` plugin with a CVSS score of **8.1**, and **CVE-2026-48844**, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as **CVE-2026-48845** through **CVE-2026-48849**, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities. Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include **y0us**, **Georgios Tsimpidas**, **flydragon777**, the **Martila Security Research Team**, **aikido_security**, and **nullcathedral**. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
Jun 29, 2026
Roundcube released versions **1.6.19** and **1.7.4** for the 1.6 LTS and 1.7 branches, remediating 12 vulnerabilities in its webmail platform. The fixes include a zero-click stored cross-site scripting flaw involving injected TNEF MIME tags in attachment URLs, an additional XSS issue in `text/enriched` email handling, and several email-header injection vulnerabilities that could permit JavaScript execution within an authenticated victim’s webmail session or manipulation of message metadata. The updates also address cross-user modification of SQL address-book contact groups, multiple bypasses of remote-content blocking, an `is_local_url()` validation bypass, and a CSS-proxy server-side request forgery bypass that could enable requests to internal resources. Organizations running affected Roundcube 1.6.x or 1.7.x deployments should upgrade promptly to the patched releases.
Sep 7, 2026
Roundcube has released **Webmail 1.6.18** and **1.7.3** to fix **11 security vulnerabilities**, led by **`CVE-2026-74997`**, a high-severity remote code execution flaw in the **markasjunk** plugin’s **`cmd_learn`** driver. The bug, classified as **CWE-78**, affects **Roundcube 1.6.x before 1.6.18** and **1.7.x before 1.7.3** and can be triggered through crafted placeholder replacement values, potentially allowing command execution on the mail server with impacts to confidentiality, integrity, and availability. Roundcube urged all production deployments to upgrade, and administrators were advised to disable the **markasjunk** plugin if it is not needed. The security updates also address SSRF filter bypasses, remote content blocking bypass, LDAP filter injection, arbitrary Sieve script injection, IMAP command injection, stored XSS, HTML/CSS sanitization bypasses, and a **modoboa** password-driver issue that could leak an authentication token to a user-controlled host. Roundcube said the flaws could expose webmail environments to mail theft, persistence, and lateral movement if left unpatched, and recommended restricting outbound connectivity from Roundcube hosts in addition to applying the new releases.
Aug 18, 2026