We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail. They both contain fixes for recently reported two security vulnerabilities.

Security fixes

• Fix CSS injection vulnerability reported by CERT Polska.
• Fix remote image blocking bypass via SVG content reported by nullcathedral.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.13 and 1.5.13.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.5.x with this new versions.

Source: https://roundcube.net/news/2026/02/08/security-updates-1.6.13-and-1.5.13
Get it Now: https://roundcube.net/download

I would consider Roundcube stable and easy to configure. It can get complex if your looking to add things like calendars, contact syncing, LDAP, Filters, etc. since all of those things are very environment specific.

I've run Roundcube on very small servers with any issues, as long as you run PHP it doesn't take up many resources.

Hi team,
I'm working on a personal mail server project and I'm hesitating to go with Roundcube for webmail. It seems to be the gold standard, but I'm afraid of getting bogged down in a nightmare installation. Honestly, guys, how stable is it? I'm looking for something solid that runs without me having to spend all night on it. I've seen links to support forums for netlinking and visibility, but I'm really interested in the pure technical side of things. Does anyone run this on a small configuration? Is it smooth, or does it slow down when there's a bit of traffic? I don't want to set up a complicated system just to read three messages.

Quote from: SKaero on January 28, 2026, 12:11:04 AMIt would need to be done from a API call from the front end code in order for the message to be shown. Can you share more of the code so we can have a better idea how the code is running?

I don't think I can. I'm trying to make small changes to code that isn't mine, so I don't think I can share any more of it.

I'll keep digging though the code of various plugins and may be able to find some more clues as to how to do this.

Quote from: senaiboy on February 01, 2026, 10:28:24 PM1. Preferences > Virus Protection
2. Preferences > Spam Settings
3. Preferences > Blacklisted addresses
4. Preferences > Whitelisted addresses

I don't see any of those in my cPanel install of Roundcube so I think those maybe custom to your cPanel install. If you have control of the server then you could look at the installed files to see what they are but otherwise I'd have to guess that there something custom.

Apologies for hijacking the post, we are similarly migrating from cpanel's Roundcube to one hosted on our own server. Still unable to find several settings:

1. Preferences > Virus Protection
2. Preferences > Spam Settings
3. Preferences > Blacklisted addresses
4. Preferences > Whitelisted addresses

Are these all from a third party plugin? Have had a look at the installed plugins, no clue from there where these might have come from.

Can emails in the Junk folder be automatically cleared (eg after 30 days) like in the Trash folder? Is there a plugin to do this?

Roundcube doesn't handle the spam filtering, you would need to configure that on the mail server or sub system that handle spam filtering.

Not junk messages are still being put into the junk folder, I've tried for a long time selecting them & clicking not junk but the system isn't learning.
How can I stop this happening. I want all my messages to go into the inbox so that I get them delivered & let me decide on them.

How do I chnage the columns displayed in the message list?

The documentation I have found (at https://docs.roundcube.net/doc/help/1.1/en_US/mail/mailview.html) says "The columns displayed in the list can be adjusted by clicking the List Options icon in the leftmost column of the message list header.".

Another page I have found at https://squirrelhouse.biz/roundcube-mail-altering-displayed-columns/ shows an image of this (see first attachment).

But I don't see any column headings - for what I see, please see the second attachment.

This is Roundcube 1.6.12 with (I think) skin elastic.

How do I make column headings show, please? (and then, g=hopefully, I'll be able to see the "List Options" icon).