Loading story…
Roundcube released versions 1.6.17 and 1.7.2 to address multiple security flaws in its webmail platform, including stored cross-site scripting, SSRF bypasses, password plugin issues tied to session-injected usernames, and denial-of-service conditions in TNEF message handling. The advisory highlights CVE-2026-54432, a stored XSS issue caused by an unescaped attachment MIME type on the attachment-validation warning page, and CVE-2026-54433, described as a zero-click stored XSS triggered during plain-text rendering.
The fixes also resolve an infinite loop in the TNEF decoder, expanding the impact beyond browser-side compromise to service disruption risks. A related Nuclei template update added detection coverage for CVE-2026-54433, reflecting active defender interest in identifying exposed Roundcube instances. Roundcube also warned that the unsupported 1.5 LTS branch has reached end of support and may remain vulnerable to these issues as well as earlier flaws fixed in 1.6.16 and 1.7.1.
See affected versions and whether adversaries are exploiting it.
3 events from the most recent confirmed update back to the earliest known activity.
A GitHub pull request added and updated a Nuclei template entry for CVE-2026-54433, describing it as a critical zero-click stored XSS vulnerability in Roundcube Webmail. The visible discussion indicates follow-up edits to the associated YAML file on 2026-07-22.
In the same security notice, Roundcube warned that the unsupported 1.5 LTS branch had reached end of support and was likely affected by at least some of the newly addressed issues as well as earlier flaws fixed in 1.6.16 and 1.7.1. No specific date for the end-of-support event is provided in the source content.
On 2026-07-05, Roundcube released versions 1.6.17 and 1.7.2 to fix multiple vulnerabilities in its webmail software, including stored XSS, SSRF bypasses, password plugin issues, and TNEF-related denial-of-service and infinite loop flaws. The advisory explicitly mentions CVE-2026-54432 and CVE-2026-54433 among the fixed issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourceseclists.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Roundcube released versions **1.6.19** and **1.7.4** for the 1.6 LTS and 1.7 branches, remediating 12 vulnerabilities in its webmail platform. The fixes include a zero-click stored cross-site scripting flaw involving injected TNEF MIME tags in attachment URLs, an additional XSS issue in `text/enriched` email handling, and several email-header injection vulnerabilities that could permit JavaScript execution within an authenticated victim’s webmail session or manipulation of message metadata. The updates also address cross-user modification of SQL address-book contact groups, multiple bypasses of remote-content blocking, an `is_local_url()` validation bypass, and a CSS-proxy server-side request forgery bypass that could enable requests to internal resources. Organizations running affected Roundcube 1.6.x or 1.7.x deployments should upgrade promptly to the patched releases.
Sep 7, 2026
Roundcube released security updates for its webmail software to fix multiple vulnerabilities affecting versions prior to `1.6.14`, including a pre-authentication arbitrary file write tied to unsafe deserialization in the Redis/Memcache session handler and tracked externally as `CVE-2026-35537`. The updates in versions `1.5.14` and `1.6.14` also addressed a password change issue, an IMAP injection flaw with CSRF bypass, several remote image blocking bypasses, a fixed-position mitigation bypass, an XSS issue in HTML attachment preview, and an SSRF plus information disclosure weakness involving stylesheet links to local network hosts. Roundcube noted that `1.7` pre-release builds were also affected. A follow-up release in versions `1.5.15` and `1.6.15` corrected regressions introduced by the earlier fixes and patched an additional cross-site issue described as an SVG Animate FUNCIRI attribute bypass, which could allow remote image loading through `fill`, `filter`, and `stroke` attributes. That flaw was reported by class_nzm and appears to be tracked as `CVE-2026-35545`, extending the remediation effort beyond the initial advisory as administrators were urged to move to the latest patched builds.
Jun 29, 2026
Roundcube Webmail released urgent security updates to fix multiple high-risk vulnerabilities across supported branches, including versions **1.6.16** and **1.7.1**, following earlier fixes in **1.6.14** for the 1.6.x line. The newly disclosed issues include **CVE-2026-48842**, a pre-authentication SQL injection flaw in the `virtuser_query` plugin with a CVSS score of **8.1**, and **CVE-2026-48844**, a code injection bug tied to direct code evaluation in LDAP autovalues configuration that could enable arbitrary command execution. Additional patches address XSS, session poisoning, arbitrary file deletion, and SSRF bypass vulnerabilities tracked as **CVE-2026-48845** through **CVE-2026-48849**, and a dCERT advisory also lists Roundcube as affected by multiple vulnerabilities. Earlier Roundcube fixes had already addressed a separate set of severe weaknesses, including a pre-authentication arbitrary file write issue in Redis and Memcached session handlers that could lead to unauthenticated remote code execution and full server compromise, along with account takeover, SSRF, IMAP injection, CSRF bypass, and HTML attachment preview XSS. Researchers credited across the disclosures include **y0us**, **Georgios Tsimpidas**, **flydragon777**, the **Martila Security Research Team**, **aikido_security**, and **nullcathedral**. Roundcube described the releases as stable and urged administrators to back up systems and deploy updates quickly to protect exposed email infrastructure from pre-authentication exploitation.
Jun 29, 2026