Software-update: Roundcube Webmail 1.6.17 / 1.7.2

Er zijn updates verschenen voor versies 1.6 en 1.7 van Roundcube Webmail die diverse beveiligensproblemen moeten verhelpen. Roundcube Webmail biedt een webinterface om e-mail te kunnen lezen en verzenden. Het heeft onder andere ondersteuning voor gedeelde mappen en namespaces, internationalized domain names en SMTP-afleverstatusnotificaties. Daarnaast is de gebruikersinterface voor IMAP-mappen aangepast om zo meer ruimte te bieden voor extensies en plug-ins. De changelog voor beide versies kan hieronder worden gevonden.

Security updates 1.6.17 and 1.7.2 released

We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

Fix an infinite loop in TNEF (winmail.dat) decoder (#10193).Fix various vulnerabilities in the password plugin using session-injected username.Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432].Fix SSRF bypass via specific local address URLs - two new cases.Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433].Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file.

Fix an infinite loop in TNEF (winmail.dat) decoder (#10193).

Fix various vulnerabilities in the password plugin using session-injected username.

Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432].

Fix SSRF bypass via specific local address URLs - two new cases.

Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433].

Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.17 and 1.7.2. We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

Source: Tweakers.net