Loading story…
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions 1.6.16 and 1.7.1, following earlier fixes in 1.6.14 for the 1.6.x line. The newly disclosed issues include CVE-2026-48842, a pre-authentication SQL injection flaw in the virtuser_query plugin with a CVSS score of 8.1, and CVE-2026-48844, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as CVE-2026-48845 through CVE-2026-48849, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities.
Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include y0us, Georgios Tsimpidas, flydragon777, the Martila Security Research Team, aikido_security, and nullcathedral. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
The Roundcube development team released urgent security updates in versions 1.6.16 and 1.7.1 to remediate multiple high-risk vulnerabilities. These included CVE-2026-48842, a pre-authentication SQL injection flaw in the virtuser_query plugin, CVE-2026-48844 for code injection via LDAP autovalues, and additional XSS, session poisoning, arbitrary file deletion, and SSRF bypass issues.
dCERT published Advisory 2026-1644 covering multiple vulnerabilities in Roundcube Webmail. The reference provides the advisory publication as a dated milestone in the disclosure timeline.
Roundcube published its vendor announcement for security updates 1.6.16 and 1.7.1, marking the release of fixes for multiple high-risk vulnerabilities in the webmail software. The announcement establishes 2026-05-24 as the dated release milestone for these updates.
Roundcube Webmail released version 1.6.14 for the 1.6.x branch to fix multiple severe vulnerabilities, including a pre-authentication arbitrary file write issue that could lead to remote code execution, along with SSRF, account takeover, IMAP injection, CSRF bypass, and XSS issues. The project urged administrators to update production deployments promptly and back up database and application data before upgrading.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcesecurityonline.info
Open sourcedcert.de
Open sourceroundcube.net
Open sourcecybersecuritynews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube has released **Webmail 1.6.18** and **1.7.3** to fix **11 security vulnerabilities**, led by **`CVE-2026-74997`**, a high-severity remote code execution flaw in the **markasjunk** plugin’s **`cmd_learn`** driver. The bug, classified as **CWE-78**, affects **Roundcube 1.6.x before 1.6.18** and **1.7.x before 1.7.3** and can be triggered through crafted placeholder replacement values, potentially allowing command execution on the mail server with impacts to confidentiality, integrity, and availability. Roundcube urged all production deployments to upgrade, and administrators were advised to disable the **markasjunk** plugin if it is not needed. The security updates also address SSRF filter bypasses, remote content blocking bypass, LDAP filter injection, arbitrary Sieve script injection, IMAP command injection, stored XSS, HTML/CSS sanitization bypasses, and a **modoboa** password-driver issue that could leak an authentication token to a user-controlled host. Roundcube said the flaws could expose webmail environments to mail theft, persistence, and lateral movement if left unpatched, and recommended restricting outbound connectivity from Roundcube hosts in addition to applying the new releases.
Aug 18, 2026
Roundcube released security updates for its webmail software to fix multiple vulnerabilities affecting versions prior to `1.6.14`, including a pre-authentication arbitrary file write tied to unsafe deserialization in the Redis/Memcache session handler and tracked externally as `CVE-2026-35537`. The updates in versions `1.5.14` and `1.6.14` also addressed a password change issue, an IMAP injection flaw with CSRF bypass, several remote image blocking bypasses, a fixed-position mitigation bypass, an XSS issue in HTML attachment preview, and an SSRF plus information disclosure weakness involving stylesheet links to local network hosts. Roundcube noted that `1.7` pre-release builds were also affected. A follow-up release in versions `1.5.15` and `1.6.15` corrected regressions introduced by the earlier fixes and patched an additional cross-site issue described as an SVG Animate FUNCIRI attribute bypass, which could allow remote image loading through `fill`, `filter`, and `stroke` attributes. That flaw was reported by class_nzm and appears to be tracked as `CVE-2026-35545`, extending the remediation effort beyond the initial advisory as administrators were urged to move to the latest patched builds.
Jun 29, 2026
Roundcube released security updates **1.6.11** and **1.5.10** to fix **CVE-2025-49113**, a critical post-authentication remote code execution flaw in its open-source webmail platform. The vulnerability affects versions earlier than **1.6.11** and the LTS branch earlier than **1.5.10**, and stems from improper sanitization of the `_from` parameter in `/program/actions/settings/upload.php`, which can lead to **PHP object deserialization** and arbitrary code execution. Researchers and national defenders reported that the flaw is being **actively exploited** and that public analysis of the June hotfix helped attackers develop working exploits. FearsOff published technical research and proof-of-concept details, while CSIRT.SK said exploit code is being sold on hacker forums and warned that attackers may obtain the required authenticated access through phishing, brute-force, or CSRF. Administrators were urged to upgrade immediately and review Roundcube, network, and security logs for signs of compromise.
Jul 24, 2026