Roundcube Fixes Zero-Click XSS, SSRF, and 10 Other Webmail Flaws
Vulnerability Disclosure · 2 sources · Updated 2mo ago · First seen Sep 7, 2026
Roundcube released versions 1.6.19 and 1.7.4 for the 1.6 LTS and 1.7 branches, remediating 12 vulnerabilities in its webmail platform. The fixes include a zero-click stored cross-site scripting flaw involving injected TNEF MIME tags in attachment URLs, an additional XSS issue in text/enriched email handling, and several email-header injection vulnerabilities that could permit JavaScript execution within an authenticated victim’s webmail session or manipulation of message metadata.
The updates also address cross-user modification of SQL address-book contact groups, multiple bypasses of remote-content blocking, an is_local_url() validation bypass, and a CSS-proxy server-side request forgery bypass that could enable requests to internal resources. Organizations running affected Roundcube 1.6.x or 1.7.x deployments should upgrade promptly to the patched releases.
