Roundcube fixes 20 security bugs including two IMAP injections
Versions 1.6.20 and 1.7.5 close two CRLF-based command injection flaws and an SSRF filter bypass in the open-source webmail client most hosting providers bundle by default.
Roundcube shipped 1.6.20 and 1.7.5 on 19 October, patching 20 security bugs in a single release. The two most serious are IMAP command injection flaws, both triggered by smuggling a CRLF sequence into a URL parameter: one in _uid, used by the message-viewing actions, the other in _flag, used when marking mail. The release also fixes an object-injection primitive in session handling, an SSRF filter bypass via a NAT64 address range, and several ways a crafted email could inject extra mail headers or dodge Roundcube’s remote-content blocking.
Roundcube accounts for 87.7% of all webmail clients tracked by W3Techs as of October 2026, the software most hosting providers hand users as “webmail” on a shared server.
Why it matters: none of the 20 fixes are flagged as under active attack, but a webmail client sits directly in the path of every message an attacker can send it, so header-injection and content-blocking bypasses tend to get weaponised fast once they’re public. Anyone running Roundcube, directly or through a hosting control panel, should move to 1.6.20 or 1.7.5 now rather than wait for the next bundled update.
The caveat: most of the injection bugs need either an authenticated webmail session or a victim opening a crafted email, not a bare unauthenticated network exploit.