Roundcube Webmail 1.6.20 and 1.7.5: security release fixes about 20 flaws, including authenticated IMAP command injection (CVE-2026-113386, CVSS 7.1), header injection, XSS, CSRF and SSRF-filter bypasses

Roundcube published security updates 1.6.20 (1.6 LTS) and 1.7.5 on 19 October 2026 and says it strongly recommends updating all production installations of 1.6.x and 1.7.x. The release notes list about 20 security fixes. The first to get a CVE record, CVE-2026-113386 (published 20 October, CVSS 3.1 score 7.1), lets a logged-in user inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to run arbitrary IMAP commands; a similar IMAP injection through the _flag parameter of mail/mark is also fixed. Other fixes cover mail header injection in the bounce (resend), forward-as-attachment and reply paths, an XSS in password driver error responses, a CSRF check bypass in mark-as-junk, an SSRF filter bypass using NAT64 addresses, remote-content blocking bypasses via SVG and CSS, unsafe attachment content passed to ImageMagick during image resizing, an object injection primitive in session handling, deprecated action aliases that ignored the disabled_actions setting, and a Modoboa password driver bug that could change another account's password. Roundcube has not said any of these are being exploited, but earlier Roundcube flaws have been exploited in the wild, so patch promptly. Primary: Roundcube.

Product

Roundcube Webmail (open-source webmail)

Versions

1.6.0 up to before 1.6.20 and 1.7.0 up to before 1.7.5 affected (per CVE-2026-113386). Fixed: 1.6.20 and 1.7.5.

CVSS

7.1 (CVSS 3.1) for CVE-2026-113386; other fixes have no CVE scores yet

Exploited in Australia?

unknown

Patch to

Update to Roundcube 1.6.20 or 1.7.5, or the patched package from your Linux distribution or hosting panel when it lands. If you use the password plugin with the Modoboa driver, update before re-enabling password changes. Review IMAP server logs for unusual commands from webmail sessions.

Primary: Roundcube — Security updates 1.6.20 and 1.7.5 released (19 Oct 2026) · Vendor: CVE record — CVE-2026-113386 Roundcube IMAP command injection via _uid (CVSS 7.1; 20 Oct 2026) · CVE: CVE-2026-113386 · GitHub — Roundcube Webmail 1.7.5 release notes

vulnerabilities