Roundcube fixes arbitrary file write and multiple webmail security flaws

Roundcube released security updates for its webmail software to fix multiple vulnerabilities affecting versions prior to 1.6.14, including a pre-authentication arbitrary file write tied to unsafe deserialization in the Redis/Memcache session handler and tracked externally as CVE-2026-35537. The updates in versions 1.5.14 and 1.6.14 also addressed a password change issue, an IMAP injection flaw with CSRF bypass, several remote image blocking bypasses, a fixed-position mitigation bypass, an XSS issue in HTML attachment preview, and an SSRF plus information disclosure weakness involving stylesheet links to local network hosts. Roundcube noted that 1.7 pre-release builds were also affected.

A follow-up release in versions 1.5.15 and 1.6.15 corrected regressions introduced by the earlier fixes and patched an additional cross-site issue described as an SVG Animate FUNCIRI attribute bypass, which could allow remote image loading through fill, filter, and stroke attributes. That flaw was reported by class_nzm and appears to be tracked as CVE-2026-35545, extending the remediation effort beyond the initial advisory as administrators were urged to move to the latest patched builds.