Roundcube Webmail has rolled out updates for versions 1.6 LTS and 1.7 to plug a dozen security holes that could threaten both users and servers. The patched flaws span cross-site scripting (XSS), email header injection, server-side request forgery (SSRF), remote-content bypasses, and improper access to other users’ address book data. Administrators running Roundcube version 1.6.x or 1.7.x are strongly advised to apply the new releases—1.6.19 and 1.7.4—as soon as possible.
Key Vulnerabilities Addressed
One of the gravest vulnerabilities now amended is a zero-click stored XSS issue involving TNEF MIME tags embedded in attachment URLs, which could execute malicious scripts simply by viewing a message—no clicks required. Another serious XSS hole resided in the HTML editor when handling enriched email content. Attackers exploiting these bugs might hijack session tokens, alter mailbox settings, read or manipulate messages, or operate as authenticated users.
Another batch of fixes closes multiple email header injection weaknesses. Vulnerable fields included the subject line, recipient display name, and identity organization tag—any one of which could be manipulated if user input wasn’t properly sanitized. These bugs previously risked allowing toxic header insertions or metadata tampering.
Remote Content, SSRF, and Cross-User Access Flaws
Remote-content protections have also been hardened. New patches counter CSS declaration smuggling, CSS-escape bypasses in FuncIRI attributes, HTML background property manipulation, and SVG SMIL animation-based bypasses. One specific issue involved a validation bypass in Roundcube’s is_local_urlfunction where stylesheet URLs with fully qualified domain names ending in a trailing dot could slip through restrictions.
An SSRF bypass in Roundcube’s CSS proxy has been rectified. The flaw allowed abuse of IPv6-mapped IPv4 addresses using hexadecimal notation to evade address validation, enabling attackers to trick the server into making unauthorized requests—potentially into internal or restricted networks.
Also fixed is a cross-user access problem affecting SQL-based address books. Under certain conditions, one user could add or remove members from another user’s contact groups, compromising address privacy and data integrity especially in shared or hosted environments.
Roundcube’s release notes for versions 1.6.19 and 1.7.4 contain full technical disclosures. The development team urges all organizations running affected versions to update without delay.
This follows a broader trend of vulnerabilities stemming from untrusted input in webmail systems, especially when handling HTML, CSS, or attachments. In hosted services or multi-tenant environments, even a single weak server-side validation can lead to privilege escalation, data leakage, or lateral movement within internal networks.
For admins of Roundcube deployments, the message is clear: updating is not optional—these flaws are serious, varied, and exploitable. The breadth of issues—zero-click attacks, SSRF, address-book tampering—underscores how critical thorough input sanitization and strict content filtering have become in modern webmail security.
