Roundcube Patches 20 Vulnerabilities, Including Six High-Severity Flaws

Roundcube released Webmail versions 1.6.20 and 1.7.5 to address 20 vulnerabilities, including six rated high severity, prompting advisories from Italian, Canadian and Beninese cybersecurity authorities. Affected installations include the 1.6.x branch before 1.6.20 and the 1.7.x branch before 1.7.5. The flaws span IMAP command and email-header injection, server-side request forgery protection bypasses, cross-site request forgery, session-management weaknesses, unauthorized password changes through the Modoboa driver, and unsafe attachment processing through ImageMagick. Benin’s CSIRT warned that impacts could include compromised account and data confidentiality and integrity and, depending on the flaw, remote arbitrary code execution.

One patched vulnerability, CVE-2026-114716, allows a remote authenticated attacker to inject arbitrary MIME part headers into outgoing messages by placing CRLF sequences in the media type of an inline image data URI. The flaw requires no user interaction and stems from missing media-type validation; the fix adds that validation. Administrators should prioritize upgrading to the fixed release for their branch, disable unused plugins and password drivers, and review access and IMAP logs. The supplied advisories do not report active exploitation.