Roundcube patches critical markasjunk RCE and 10 other webmail flaws
Vulnerability Disclosure · 6 sources · Updated 3mo ago · First seen Aug 17, 2026
Roundcube has released Webmail 1.6.18 and 1.7.3 to fix 11 security vulnerabilities, led by CVE-2026-74997, a high-severity remote code execution flaw in the markasjunk plugin’s cmd_learn driver. The bug, classified as CWE-78, affects Roundcube 1.6.x before 1.6.18 and 1.7.x before 1.7.3 and can be triggered through crafted placeholder replacement values, potentially allowing command execution on the mail server with impacts to confidentiality, integrity, and availability. Roundcube urged all production deployments to upgrade, and administrators were advised to disable the markasjunk plugin if it is not needed.
The security updates also address SSRF filter bypasses, remote content blocking bypass, LDAP filter injection, arbitrary Sieve script injection, IMAP command injection, stored XSS, HTML/CSS sanitization bypasses, and a modoboa password-driver issue that could leak an authentication token to a user-controlled host. Roundcube said the flaws could expose webmail environments to mail theft, persistence, and lateral movement if left unpatched, and recommended restricting outbound connectivity from Roundcube hosts in addition to applying the new releases.
