We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

• Fix CSS declaration smuggling via un-encoded ampersand emission, reported by Zach Hanley of Horizon3.ai
• Fix CSS property injection via body background attribute, reported by zenithhostingevan
• Fix email header injection via bare CR in the subject field, reported by CVE-Hunter-Leo
• Fix email header injection via C-escape \r in the recipient display name, reported by dogeshark
• Fix email header injection via identity's organization field, reported by dogeshark
• Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL, reported by nakko
• Fix XSS in the HTML editor using text/enriched part content, reported by Joshua Rogers
• Fix cross-user access in contact group membership (add/remove) in the SQL address book, reported by Joshua Rogers
• Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL, reported by nept1337
• Fix remote content blocking bypass via CSS escapes in FuncIRI attributes, reported by Wahab KHADIR
• Fix remote-content blocker bypass via SVG SMIL src animation
• Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses, reported by faceless0x7 and Harish Annavisamy

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.19 and 1.7.4.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

Source: https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4
Get it Now: https://roundcube.net/download

Quote from: Seb1k on June 01, 2024, 05:39:51 AM+ Added PWA support

How do I enable PWA on android?

Hallo,

wir haben zur Zeit Roundcube Webmail 1.6.17 zum testen eingerichtet und sind jetzt schon begeistert.

Es gibt unter:
Einstellungen - Postfachansicht - Allgemein - Nachricht als gelesen markieren - folgende Einstellung:
"nie", "sofort" oder zum Beispiel "nach 30 Sekunden".

Gerne würden wir den Wert auf zum Beispiel 400 Sekunden einstellen lassen,
da wir aus organisatorischen Gründen die Nachricht nicht als "gelesen"
markiert haben wollen.
Kann man es diese Werte manuell anpassen?

Vielen Dank im Voraus.

Viele Grüße
Frank

I guess sorting by message size is no longer allowed.

Does anybody on here know how to get the default PassWord plugin running properly?!  Thanks!  :--)

Hi,
looks very nice and modern. But for me, the black folder list compared to the clear, white message list and message view is a little disturbing and the black/grey is hard to read. It would be great, when the the folder column colour would follow the message pane colour. Dark mode -> all dark, light mode -> all light. Or even a switch to select the colour of the folder column would be a great help.

Except of this it would be my theme :-) Great work, thanks a lot.

Dear JohnDoh,

perhaps you might reconsider that i asked for a .deb package, official or not. I'm able to install roundcube from .tar.gz, but that breaks the automation that comes with the ubuntu package system and requires more attention to updates and new dependencies.

Kind regards,
QNo

can you try uploading your screenshot to a public location?

QuoteI've tried muitiple times on multiple different roundcube places

Roundcube is a web based IMAP client, it is not a service. There is no such thing as a "Roundcube account".

I guess from your post the seller is not being helpful. May be you could try reaching out to whoever runs the email for rskfc.com

I bought a game account that had an email ([email protected]) and now I can't find a way to login to this email anymore. I've tried muitiple times on multiple different roundcube places and can not for the life of me figure out how to login to this email now.