We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

• Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K.
• Fix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe.
• Add a size limit to the CSS proxy content processing, reported by Milan Hoppe.
• Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
• Fix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe.
• Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe.
• Fix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo
• Fix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay.
• Fix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy.
• Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys, reported by Oli Z.
• Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW.
• Fix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW.
• Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix mail header injection via subject of a message forwarded as attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix mail header injection via media type in an inline image data URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix bug where Password Modoboa driver could change password for another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
• Fix unsafe use of a login name in SquirrelMail import file path, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.20 and 1.7.5.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

Source: https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Get it Now: https://roundcube.net/download

Hi everyone, Just a quick look back at an issue I had three weeks ago on an OVH VPS that I manage. One of my clients contacted me because he wasn't receiving any emails from his website's contact form anymore. There were no server-side errors, and SMTP was accepting everything normally, so at first I was looking in the wrong place. I ended up combing through the ManageSieve logs for an entire evening, and that's when I found the filter that was sending emails straight to the spam folder.

It turned out the problem stemmed from the Sieve rules I'd configured using fairly broad keywords to filter out typical spam.

The client in question runs a directory of porn sites, categorized into over 100 categories, and it was precisely the contact and partnership emails from this site that were ending up in spam. It makes sense when you look at the content of the rules... but it hadn't jumped out at me right away. I had to exclude the sender address from the contact form from the keyword filtering rules. Since then, there haven't been any issues. If anyone else has experienced similar false positives with ManageSieve due to overly generic keywords, I'd love to hear your feedback.

Its feasible since Roundcube is a IMAP webmail client, you just need to reach out to your family relative who setup Roundcube to get the details to put into that mail client.

My family relative setup a roundcube inbox , hosted on their server. e.q. https://xxxx.xx/roundcube

I use username and pass to login on PC ok

but I would like to use a java applet on sony ericsson with POP3/IMAP function to 'retrieve' messages from this roundcube inbox.

the list in post 1 is the info the applet requires... Isn't it feesible?

Roundcube is a web based IMAP client. Please contact your email provider for connection details for other clients.

Hi,

I'd like to setup a POP3/IMAP client in 'primitive' J2ME environment (old sony phone)

the simple j2me app is asking for
Address
Local host
Inbox type POP3/IMAP
Inbox host
Username
Password
Inbox port
SMTP host
SMTP password

which of these are bare minimum for accessing a roundcube inbox?

thanks in advance.

story: I've used html gmail for many years on java web browser opera mini but this was phased couple years ago, so i config gmail to forward email to temp yandex inbox which still has html but annoyingly yandex opted to enforce QR code 2FA login app.

Quote from: SKaero on October 10, 2026, 12:10:22 AMSounds like there is a problem with your mime magic database file. I'm not sure on what options there are to fix that on FreeBSD but Roundcube does have config option to set a custom path to one if you need to:

Code Select Expand

// Path to a local mime magic database file for PHPs finfo extension.
// Set to null if the default path should be used.
$config['mime_magic'] = null;


Thanks a ton, the roundcube config did point to a wrong file. Setting it to the default path as you suggested fixed things.

Thanks a lot, I'll look into that!

Sounds like there is a problem with your mime magic database file. I'm not sure on what options there are to fix that on FreeBSD but Roundcube does have config option to set a custom path to one if you need to:
// Path to a local mime magic database file for PHPs finfo extension.
// Set to null if the default path should be used.
$config['mime_magic'] = null;


Roundcube 1.7.4, php 8.3.33, FreeBSD 14.4

Roundcube is unable to attach files with certain extension to a mail (e. g. .png, .jpg, .svg). Other file extensions work just fine (e. g. .pdf, .docx, .xls).

Trying to upload a .svg file, for example, logs the following error. Errors for .png and .jpg look identical.

------
[09-Oct-2026 20:35:18 Europe/Berlin] PHP Fatal error:  Uncaught Exception: finfo::__construct(): EXTENSION type `               journal~' has bad char '~' in /usr/local/www/roundcube/program/lib/Roundcube/rcube_mime.php:745
Stack trace:
#0 /usr/local/www/roundcube/program/lib/Roundcube/rcube_mime.php(745): finfo->__construct(1040, '/usr/share/misc...')
#1 /usr/local/www/roundcube/program/actions/mail/attachment_upload.php(109): rcube_mime::file_content_type('/tmp/phpF8Txhh', 'test.svg', 'image/svg+xml')
#2 /usr/local/www/roundcube/program/include/rcmail.php(280): rcmail_action_mail_attachment_upload->run(Array)
#3 /usr/local/www/roundcube/public_html/index.php(266): rcmail->action_handler()
#4 {main}
  thrown in /usr/local/www/roundcube/program/lib/Roundcube/rcube_mime.php on line 745
------

Any ideas what could be causing this?

Cheers
sheep2045