Roundcube Fixes 20 Flaws (DSA-6579-1): Update to 1.6.20 or 1.7.5

I noticed Debian's DSA-6579-1 email, issued on 23 Oct. 2026, about Roundcube, with a list of 20 CVEs, so I went back to the upstream sources to see what had happened. I found that the Roundcube project had already released fixes on 19 Oct. in 1.6.20 (the LTS branch) and 1.7.5, with Debian following later. For mail server administrators, webmail is exposed to the internet on almost every server anyway, so I want you to read this one without skipping over it.

What happened

The release notes for Roundcube 1.6.20 and 1.7.5 each list 20 security fixes, without CVE numbers in the notes themselves. Debian lists 20 CVEs (CVE-2026-113386 and CVE-2026-114714 through CVE-2026-114732), but does not map them to individual vulnerabilities, and the descriptions in Debian's tracker are still "unspecified". I therefore cannot say which CVE corresponds to which issue, and can only group the fixes from the upstream release notes as follows.

• IMAP command injection Newline characters (CRLF) in the _uid parameter of the headers and viewsource pages and the _flag parameter of mark allow additional IMAP commands to be injected.
• Authentication and permissions Alias logins are not bound to an IMAP host, disabled_actions can be bypassed through legacy action names, CSRF protection for marking messages as junk can be bypassed, and the Modoboa password driver can change another account's password.
• SSRF and external content blocking is_local_url() can be bypassed with NAT64 addresses, and external image blocking can be bypassed with SVG SMIL and CSS escapes.
• Header injection The sender name during Bounce, References/In-Reply-To/Message-ID/From values, the subject of forwarded attachments, and the media type of data URI images.
• XSS and CSS CSS scoping can be bypassed with at-rules, and there is XSS in password driver error messages.
• Other issues Object injection in rcube_session::unserialize(), unsafe attachments passed to ImageMagick during thumbnail generation, and unsafe login names in SquirrelMail import paths.

Why do I pay particular attention to webmail? Because this is where users stay logged in to their mailboxes all day. If someone else's script can run on a page displaying email (XSS), it can do almost anything with that user's permissions, including reading mail, sending mail or setting forwarding rules. And if IMAP commands can be injected, the mailbox can be instructed to do more than the web interface intended. This is a general explanation of the risks, not information from the advisory about exactly what each vulnerability allows.

Severity

I checked the Roundcube release notes, DSA-6579-1 and Debian's tracker pages, and none publishes CVSS scores or severity levels for the individual CVEs (the tracker descriptions say "unspecified issue"). I therefore will not assign numbers myself, and none of the sources I opened says there have been attacks in the wild or public exploits. The CISA KEV feed I checked also has no entries for this round of Roundcube vulnerabilities.

What the available information does tell us about urgency is the scope. The 20 vulnerabilities range from IMAP command injection and content blocking bypasses to changing another account's password through certain drivers. The project has also been issuing Roundcube security releases roughly every 4 to 6 weeks (24 May, 5 July, 9 Aug., 6 Sept., 19 Oct.), according to its news page. Anyone still running an older version therefore has several previous rounds of fixes outstanding as well as this one.

Who is affected: affected and fixed versions

DSA-6579-1 specifies a fixed version only for Debian 13. For Debian 12, I checked Debian's tracker, which marks every CVE as vulnerable, and the latest Roundcube DLA I found on the LTS page was DLA-4823-1, dated 5 Oct., before upstream released 1.6.20. If you use Debian 12, check the tracker again before deciding, because my information only goes up to 5 Nov.

How to fix it

1. Find every Roundcube installation on the server The distro package, installations managed by a control panel, and manual installations in web directories
2. Check the version of each installation Do not guess from the package name
3. Back up the files and database first The project maintainers also recommend backing up before updating
4. Update and check the version again Open the login page and a test mailbox

For Debian 13 using the distro package

dpkg-query -W -f='${Package} ${Version}\n' 'roundcube*'
sudo apt update
sudo apt install --only-upgrade 'roundcube*'
apt policy roundcube-core     # ต้องเห็น 1.6.20+dfsg-0+deb13u1 ขึ้นไป

For manual installations from a tarball, check the version in Roundcube's files, then upgrade according to the Upgrade page in the project's wiki, which describes bin/installto.sh as the easiest method. This script copies the new files over the existing ones, then runs the scripts to update the configuration and database schema. The server must have rsync, PHP's system function must not be listed in disable_functions, and the database user must have permission to modify the schema. The same page stresses backing up the entire directory and dumping the database first.

# ดูรุ่นที่ลงอยู่ (path เป็นตัวอย่าง)
grep -rn "RCMAIL_VERSION'" /path/to/roundcube/program/include/ | head -3

# สำรองไว้นอกโฟลเดอร์เว็บ (อย่าลืม dump ฐานข้อมูลด้วย) แล้วอัปเกรด
sudo cp -a /path/to/roundcube /var/backups/roundcube-before-1.6.20
tar xzf roundcubemail-1.6.20-complete.tar.gz
cd roundcubemail-1.6.20
sudo ./bin/installto.sh /path/to/roundcube

If Roundcube was installed through a control panel such as DirectAdmin, follow that panel's documentation. I did not verify the update commands against DirectAdmin's official documentation this time, so I am not including commands here. Also check whether the version the panel retrieves is already 1.6.20 or 1.7.5. If it is still an older version, running a build or update again will give you the same version.

Check whether you have been compromised

Upstream has not published indicators of compromise for this round. What I can suggest is inferred from the vulnerability list, rather than a list supplied by upstream.

• Search access logs for _uid or _flag parameters containing URL-encoded newline characters (matching the IMAP command injection issue). These are visible only in GET requests.
• Look for email forwarding rules or filters that users did not create, and unusual outgoing mail from accounts.
• Check Roundcube's errors.log for unusual IMAP errors.

grep -iE '_(uid|flag)=[^ &]*(%0d|%0a)' /var/log/apache2/access.log | head

If you find matching entries, treat the account as potentially compromised, change its password and inspect its mailbox rules. Finding nothing does not mean it is safe, because normal logs do not show values sent in POST requests.

Personally, if webmail is exposed to the internet, I would not wait for the maintenance window. I would update now, because this set of fixes covers command injection, blocking bypasses and XSS together, and Roundcube is a frequent target. For Debian 12 servers where I still see no fixed release, I would restrict access first, then decide whether to wait for a DLA or upgrade from upstream myself, depending on the staff available to maintain it.

P.S. For a read-only check of a Debian server running DirectAdmin, I have written a safe sequence in Debian shared-host server security audit

Sources: Roundcube news (roundcube.net/news), Roundcube releases 1.6.20 and 1.7.5 (github.com/roundcube/roundcubemail/releases), Debian DSA-6579-1 (lists.debian.org/debian-security-announce/2026/msg00495.html), Debian Security Tracker (security-tracker.debian.org/tracker/source-package/roundcube), Debian LTS security (debian.org/lts/security). Information current as of 5 Nov. 2026. If upstream publishes details for individual issues or Debian 12 receives a fixed release, I will return to update this article.