Security · November 12, 2026
Also published in Português (Brasil), 한국어
Multiple vulnerabilities discovered in Roundcube
Multiple vulnerabilities have been revealed in the webmail software Roundcube Webmail. The development team has provided a patch and strongly recommends users to update their systems.
On November 9, 2026, a security update, versions 1.7.6 and 1.6.21, was released to address these vulnerabilities. Although specific CVE numbers were not mentioned in the advisory, it was stated that 17 fixes have been implemented.
The updates address issues such as an open redirect that occurs during recovery from an IMAP error when retrieving attachments. Additionally, a vulnerability that allows the injection of IMAP commands by including newline characters in parameters has been fixed in environments where the message caching feature is enabled.
Multiple issues that could bypass CSS proxies and server-side request forgery (SSRF) protections have also been addressed. These vulnerabilities allowed the evasion of connection destination validation using specific domain names or IPv6 addresses.
Regarding Sieve, a tool used for email filtering, a fix was applied for a vulnerability that allowed script injection through rule operators and modifiers. In ManageSieve, which manages filtering rules, a problem was discovered that could trigger destructive operations via GET requests through external sites.