We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

Security fixes

• Add basic validation for content proxied by the css proxy
• Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
• Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
• Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe
• Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter, reported by Milan Hoppe
• Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions, reported by Milan Hoppe
• Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
• Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai
• Fix password's modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun
• Fix stored XSS in "Add to address book" action, reported by Paulos Yibelo from pwn.ai
• Fix HTML/CSS sanitization bypass via SVG animate by attribute, reported by vectrain

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.18 and 1.7.3.

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

Source: https://roundcube.net/news/2026/07/05/security-updates-1.6.17-and-1.7.2
Get it Now: https://roundcube.net/download

Agree with everyone here - I cannot stand the columns which make it hard to see which email I'm trying to access. It's extremely frustrating and hard on the eyes. Please bring back an interface with the email list on the top and the preview pane below. I've always preferred Roundcube, but I'll be forced to look  for an alternative if this isn't changed.

Contact the person who gave you access to your email account. They can help you change your password or point you to the right support.

Hi! Very nice and interesting skin!
I tested it on Roundcube 1.7.2 using the latest Firefox on Mac OS and seems to work well. I noticed two little problems:

1) in messages list, at first, the little tab with "Mark as read", "Archive" and "Delete" icons remains fixed; I need to click elsewhere to make it disappear and, after, it works correctly.

2) in the Options Panel, the "Forwarding" button has the icon in the wrong position; no problems with all the other buttons.

Except for these little glitches, this skin seems to work very well! Congratulations on your good work!

I really appreciate you question...would love to see this preview window closed, too.

Where can I Edit the word (spam), and Change that to (Spam)?

Hopefully someone can assist me...

Through my Cpanel I have access to version 1.6.17

I like the new interface except for one thing - I cannot find a way to get rid of the preview pane.

I have looked at the documentation which generally refers to the previous skin and following the directions there, at the moment, no option to remove the preview pane.

I get a lot of questionable messages which I can't even click on to delete because they immediately open.

I would appreciate any insight

J.R. Fischer

When I access my customized Email using sub domain names, the folders (Inbox...) load Differently, and sometimes they Don't show.  And the Email service appears to load slower.  And ideas about that?  Thanks!

Actually, the issues appears to also happen Without sub domains.  1 site at a time within a computer browser loads the Email folders Correctly

Hi everyone,

I'd like to share a new Roundcube skin I've built: Workbench.

It extends the standard Elastic skin and does not modify the Roundcube core or the original Elastic files — it is surface-only and fully reversible. The focus is a cleaner, application-style interface:

• Dark, icon-only navigation rail with hover tooltips (and labels on wide touchscreens)
• Light and dark mode (uses Roundcube's native toggle)
• Calm message list with initials avatars, skeleton loading and hover quick-actions
• Keyboard shortcuts with a cheat sheet ("?")
• Visible keyboard focus, WCAG-AA contrast, an accessible (aria-modal) dialog
• Clean, ink-saving print styles
• Brand-neutral and rebrandable via CSS variables (accent = --wb-accent) and replaceable logos

Compatibility: verified on Roundcube 1.6 LTS and 1.7, in Chromium/Chrome and Firefox (login, message list, reading, composing, dark mode). min-version is 1.6.0.

Install via Composer:
composer require ar-sebastian/workbench
Or download a release archive and unpack it into [tt]skins/[/tt] (results in [tt]skins/workbench/[/tt]), then set [tt]$config['skin'] = 'workbench';[/tt]

Links
GitHub: https://github.com/AR-Sebastian/roundcube-skin-workbench
Packagist: https://packagist.org/packages/ar-sebastian/workbench

Screenshots




This is a third-party skin, not an official Roundcube skin. I'd be happy to get feedback — especially regarding compatibility with different browsers, plugins and Roundcube installations.

Thanks!

Oh! I'll go check that out. Any tips? I'm new to all this stuff and can use all the help I can get!