Roundcube released versions 1.6.20 and 1.7.5 of its webmail client on October 19. Both carry the same set of 20 security fixes, and the project recommends updating all production installations. It is the fifth security update since Roundcube 1.7.0 shipped in May, and the largest, after rounds of between 6 and 12 fixes.
On servers managed with cPanel or Plesk, the update comes with the panel’s own updates. Both have shipped their recent Roundcube updates from the 1.6 branch. In the previous four rounds, cPanel & WHM 136 and Plesk Obsidian each shipped the matching Roundcube update in three to nine days.
Key facts
- No ratings yet: the release notes carry no CVE numbers or severity scores. For 1.6.18, three CVEs appeared later in cPanel’s change log.
- Branches: 1.6 is in LTS mode and receives only important security updates. The 1.5 series has been unsupported since 1.7.0 arrived in May.
- PHP: Roundcube 1.7 supports PHP 8.1 through 8.5, while the 1.6 branch officially supports PHP 7.3 through 8.3.
- Exploited before: CISA’s catalog of known exploited vulnerabilities lists 11 Roundcube flaws, the latest two added on February 20, 2026.
What the 20 Fixes Cover
| Type of fix | Fixes | Where |
|---|---|---|
| Mail header injection | 4 | From display name in Bounce, References and related parameters, subject of a message forwarded as attachment, media type of an inline image |
| IMAP command injection | 2 | _uid parameter in the headers and source view actions, _flag parameter in the mark action |
| Remote content blocking bypass | 2 | An SVG animation attribute, CSS escapes in FuncIRI attributes |
| Image processing | 2 | Unsafe attachment content passed to ImageMagick, resource limits bypassed by the GD fallback |
| CSS handling | 2 | Scoping bypass in HTML messages, missing size limit in the CSS proxy |
| Object injection, XSS, CSRF, SSRF | 4 | Session data deserialization, password driver error responses, mark-as-junk action, local URL filter via NAT64 addresses |
| Access and configuration | 4 | Alias logins not qualified by IMAP host, deprecated action aliases bypassing disabled_actions, Modoboa password driver changing another account’s password, login name in the SquirrelMail import file path |
The release notes name a reporter for every fix. A group of four researchers accounts for eight of them, and Paulos Yibelo, whose PwnEscape Linux kernel flaw we covered last week, reported the ImageMagick resize issue.
The notes carry no CVE numbers or severity scores, so there is no official ranking of the fixes yet. The practice varies between rounds. The notes for 1.6.17 listed two CVE numbers, while those for 1.6.18 listed none, and cPanel’s change log later attached three CVEs to that version.
cPanel and Plesk Ship the 1.6 Branch
Both panels have followed each 1.6 security release since May, as their change logs show.
| Roundcube version | Released | cPanel & WHM 136 | Plesk Obsidian |
|---|---|---|---|
| 1.6.16 | May 24 | June 1 | June 1 |
| 1.6.17 | July 5 | July 14 | July 9 |
| 1.6.18 | August 9 | August 17 | August 12 |
| 1.6.19 | September 6 | September 10 | September 10 |
The change log for cPanel 138 also records Roundcube updates through 1.6.19. Plesk backported security fixes to an older Roundcube 1.4.15, most recently from 1.6.16 in early June, and on June 23 moved CentOS 7 and Ubuntu 18.04 to 1.6.16.
Neither panel has moved to the 1.7 branch: every Roundcube version in their change logs is 1.6.x or older, although 1.7.0 came out in May. Users of the panels’ bundled Roundcube therefore get the security fixes for 1.6 but not the features added in 1.7, such as Markdown mail rendering and composing and improved OAuth2 and OIDC support.
As of October 19, both change logs listed 1.6.19 as the most recent Roundcube update, and Plesk’s latest release, on October 14, came before Roundcube’s. Installations set up directly from roundcube.net or GitHub need a manual update to 1.6.20 or 1.7.5, and distribution packages depend on their maintainers.
Five Security Rounds Since 1.7.0
With Roundcube 1.7.0 on May 10, the 1.6 branch moved into LTS mode, and the 1.5 series lost support. According to the project’s version history, 1.7 supports PHP 8.1 through 8.5 and 1.6 supports PHP 7.3 through 8.3. Since then, the five security rounds have brought 8, 6, 11, 12 and 20 fixes.
Some of the October fixes return to areas patched before. The notes mark one of them with “again”: a remote content blocking bypass via CSS escapes in FuncIRI attributes, which the September round also fixed. September also brought a fix for a blocking bypass through SVG animation, the same area as one of the October fixes.
Roundcube flaws have been exploited before. CISA’s Known Exploited Vulnerabilities catalog lists 11 of them, the latest two added on February 20, 2026. According to CISA, CVE-2025-49113, a deserialization flaw, allows remote code execution by authenticated users, and CVE-2025-68461 is a cross-site scripting flaw triggered through the animate tag in an SVG document.
The CISA entries concern previously disclosed vulnerabilities, while the October release notes do not report known exploitation of the newly fixed issues. For hosting providers, the practical check is which Roundcube version their panels and servers run, and when their panel vendor ships 1.6.20.
Sources
- Security updates 1.6.20 and 1.7.5 released - Roundcube
- Roundcube Webmail 1.7.5 - GitHub
- Roundcube Webmail 1.6.20 - GitHub
- Roundcube Webmail releases - GitHub
- Roundcube 1.7.0 released - Roundcube
- Version History - Roundcube Wiki on GitHub
- 136 Change Log - cPanel & WHM Documentation
- 138 Change Log - cPanel & WHM Documentation
- Change Log for Plesk Obsidian - Plesk
- Known Exploited Vulnerabilities Catalog - CISA