Multiple vulnerabilities affecting Roundcube Webmail

Roundcube Webmail is an open source webmail client that allows users to access and manage their email through a web browser. On October 19, 2026, the Roundcube development team released security updates fixing twenty vulnerabilities reported by several security researchers. The most critical vulnerabilities include the injection of IMAP commands and email headers, bypassing server-side request protection, including using NAT64 IPv6 addresses, and CSRF attacks when flagging emails as spam. Other vulnerabilities affect session management and unauthorized modification of another account's password via the Modoboa driver and ImageMagick's processing of attachments, including exposure to dangerous content and circumvention of resource consumption limits. These vulnerabilities mainly result from a failure to validate, escape and process the data provided as input. Exploitation of these vulnerabilities would allow a malicious actor to gain unauthorized access to data and, depending on the exploited vulnerability, execute arbitrary code remotely on affected systems.

• Roundcube Webmail versions 1.6.x prior to 1.6.20;
• Roundcube Webamail versions 1.7.x prior to 1.7.5;