Roundcube released versions 1.6.21 and 1.7.6 of its open-source webmail client on November 9. Both carry the same 17 security fixes. The release announcement also warns that the four-year-old 1.6 branch “will be discontinued rather soon” and urges users to plan their upgrade to 1.7.

cPanel and Plesk for Linux, which bundle Roundcube as webmail, both ship the 1.6 branch. Each shipped the previous security release, 1.6.20, on October 26, seven days after Roundcube published it. DirectAdmin moved its Roundcube installation to the 1.7 branch in May.

Key facts

  • No end date: the announcement does not say when the 1.6 branch will stop receiving security fixes.
  • Sixth round: this is the sixth pair of security releases since Roundcube 1.7.0, after rounds in May, July, August, September and October.
  • No CVEs listed: the release notes name a reporter for each fix but list no CVE numbers or severity scores.
  • PHP: version 1.7.6 enables support for PHP 8.6, while the 1.6 branch officially supports PHP versions up to 8.3.

What the 17 Fixes Cover

Injection flaws make up the largest group of the 17 fixes. Three fixes involve Sieve, a standard language for email filtering rules.

Type of fixFixesDetails
Injection5IMAP commands through the _uid parameter with the message cache enabled, Sieve scripts through a rule operator and through set and include modifiers, mail headers through the subject of a read receipt (MDN), HTTP requests through the ATD spellcheck backend
Cross-site request forgery (CSRF)3Validation bypass with file-only POST requests, validation bypass for the mail purge and expunge commands, some destructive managesieve actions triggered cross-site through GET requests
Server-side request forgery (SSRF)2Filter bypass through nip.io and sslip.io hostnames in the CSS proxy, filter bypass through 6to4 IPv6 addresses
Redirect, denial of service, attachments3Open redirect through IMAP error recovery when fetching an attachment, unbounded CPU loop in session data handling, potentially unsafe attachment content passed to ImageMagick during image type conversion
Access and configuration4disabled_actions restriction bypassed by writing an underscore instead of a hyphen in the action name, resolve_url() ignoring the trusted host setting, IMAP host input not validated strictly enough, Received: header not limited to a trusted hostname and a forwarded IP from a trusted proxy

Roundcube strongly recommends updating all production installations of 1.6 and 1.7.

The 1.6 Branch and the Move to 1.7

Roundcube 1.6 came out on July 28, 2022. When 1.7.0 shipped on May 10, 2026, the older branch moved into LTS mode with important security updates only, and the 1.5 series lost support. The November announcement gives the reason for the warning: “Backporting security patches became increasingly time consuming, annoying and error prone.”

Moving from 1.6 to 1.7 is a major version upgrade. Roundcube’s 1.7.0 announcement lists breaking changes, including a mandatory public_html entry point for web servers, dropped support for PHP versions older than 8.1 and for Microsoft SQL Server and Oracle databases, and the removal of the apc cache driver. The project encourages users to test the upgrade carefully before rolling it out.

Roundcube Fixes 20 Security Flaws, Its Largest Batch Since 1.7.0

Where cPanel, Plesk and DirectAdmin Stand

The October update reached cPanel & WHM in builds 110.0.154, 134.0.67, 136.0.51 and 138.0.19, and Plesk Obsidian for Linux in 18.0.81 Update 5. The change logs for these four cPanel versions and for Plesk list only Roundcube versions from the 1.6 branch or older. As of November 9, neither vendor’s published change log listed Roundcube 1.6.21. cPanel’s newest builds date from November 5 and Plesk’s newest updates from November 3.

On Plesk’s forum, a community manager confirmed the 1.6.20 release on October 26 and added that “the update to 1.7.5 is still in progress.”

DirectAdmin, which installs Roundcube through its CustomBuild tool, made the switch to 1.7 with version 1.702. Its change log notes that the mandatory public_html entry point required changes to the installation procedure. Roundcube is now installed in /var/www/webapps/, and its logs and temporary files moved to new directories.

On cPanel and Plesk servers, the bundled Roundcube is updated with the panel’s own builds, as the change logs show. For installations outside a control panel, both new versions are available on Roundcube’s GitHub release pages.