We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

• Fix open redirect via IMAP error recovery on attachment get, reported by Santhoshkumar S.
• Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix bug where some managesieve destructive actions could have been triggered cross-site via GET, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix Sieve script injection via a rule operator, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix Sieve script injection via set/include modifiers, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix bug where resolve_url() ignored trusted host setting, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix mail header injection via a MDN subject, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5
• Fix HTTP request injection via the spellcheck ATD backend, reported by Squirt1e, Atum, N0b0dy, Gh0u1L5.
• Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled, reported by dexx-tech.
• Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass, reported by blacksw0rd.
• Fix CSRF validation bypass for file-only POST requests, reported by skad00sh.
• Fix disabled_actions restriction bypass by writing '_' instead of '-' in the action name, reported by skad00sh.
• Fix CSRF validation bypass for mail purge/expunge commands, reported by threalwinky.
• Fix passing potentally unsafe attachment content into ImageMagick on image type conversion, reported by José Luis Sánchez Pérez - Cybersecurity Blue & Red Team.
• Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token, reported by Guang.
• Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses, reported by wyx98765.
• Fix so IMAP host input is validated more strictly, reported by Mohamed Elgzouli.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.21 and 1.7.6.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

WARNING: The 1.6 branch is four years old. Please, plan your upgrade to 1.7 soon. Backporting security patches became increasingly time consuming, annoying and error prone. 1.6 will be discontinued rather soon.

Source: https://roundcube.net/news/2026/11/09/security-updates-1.6.21-and-1.7.6
Get it Now: https://roundcube.net/download

Since I changed to using DirectAdmin this past Summer, DirectAdmin is still using the latest 1.6 version of R C.  Is that the same version that cPanel is using?  Why Doesn't DirectAdmin have 1.7 versions of R C?  :--)

(I can't see a way to mark the issue as "resolved"(?) so I'll update the title).

Quote from: SKaero on October 30, 2026, 10:43:31 AMLook in the users table and see if there are multiple records for the same account. That can happen if the mail host or username changes leading to a separation of the address book and identities.

Bingo: there are two entries for the same user. And you're absolutely right: for boring reasons, the host is now "domain.tld" rather than "mail.domain.tld".

Thank you - that was really helpful. Much appreciated!

Quote from: MobyCash on June 20, 2017, 01:32:47 AMI have deleted all my emails in trash and in my inbox but I still am unable to received emails.  I can send them but not receive them.

I know this is an old thread, but I just solved this issue so I hope it helps someone else.
My mailboxes were showing all empty, but it turns out that my trash folder had over 8K of messages that took over a FULL MINUTE to actually show up once I clicked on it.  Before I allowed it to load fully, it said the folder was empty with 0kb.

I emptied the folder, which also took a hot minute, and the problem was solved.

Look in the users table and see if there are multiple records for the same account. That can happen if the mail host or username changes leading to a separation of the address book and identities.

Hi all; see above.

I can create new identities in roundcube, and I can delete them afterwards 

...But I can't see old identities (the ones I created before I upgraded php) and they're not listed if I run: bin/identity.sh list -u <email_address>

They're definitely in the database, though: if I run "roundcube=> SELECT * FROM identities;" I can see them all. And the only ones where del=TRUE are the new ones I created then deleted.

Deleting my browser cache didn't help, and I can't see anything in the logs.

What am I missing, please?

Thank you in advance.

P.S. I can send and receive email, and obviously "$config['identities_level'] = 0;" is set in config/config.inc.php

roundcube 1.7.5
ubuntu 22.04
php 8.4.27
postgres 18.6

Dear forum members,
For some time now, I have been unable to include our logo when creating email signatures (which we use to ensure a consistent look). Upon inquiring with Vimexx, I was told that they are aware of the issue, but that there is currently no solution available. Does anyone know of a fix for this, or perhaps a workaround?

Best regards,

Please delete the thread, the community here stinks. Goodbye/. 

I would like to hide or disable the "from:" parameter when creating a notify filter. Is that possible?