Roundcube

This security update for Roundcube Webmail 1.7 fixes multiple critical vulnerabilities including RCE, SSRF, XSS, and command injection, alongside various general bug fixes.

Security update for Roundcube Webmail 1.6 addressing multiple vulnerabilities including RCE, SSRF, XSS, and command injection.

This security update for Roundcube Webmail 1.7 fixes multiple vulnerabilities including XSS, SSRF, and DoS, alongside various bug fixes for static file handling and OIDC support.

Security update for Roundcube 1.6 fixing multiple vulnerabilities including XSS, SSRF, DoS, and TNEF decoder issues, while adding Enigma plugin enhancements.

This security update for Roundcube 1.7 addresses multiple vulnerabilities including XSS, SQL injection, SSRF, and code injection, while adding HKP v1 protocol support and various bug fixes.

Security update for Roundcube 1.6 LTS addressing multiple vulnerabilities including XSS, SQL injection, SSRF, and remote code execution.

Roundcube 1.7 introduces Markdown support, improved OAuth2/OIDC, advanced search syntax, and a mandatory public_html entry-point while updating PHP requirements.

Roundcube 1.7 release candidate fixes a security vulnerability regarding SVG remote image loading and adds new configuration and driver support.

This security update for Roundcube 1.6 fixes a remote image loading vulnerability and resolves regressions related to mail search and data URL images.

This security update for Roundcube 1.5 fixes a remote image loading vulnerability via SVG Animate and resolves regressions related to mail search and data URL images.

Roundcube Webmail 1.7 release candidate focuses on fixing multiple security vulnerabilities, including XSS, SSRF, and arbitrary file write, alongside general bug fixes and a new password hashing method.

Security update for Roundcube 1.6 addressing multiple vulnerabilities including arbitrary file write, XSS, SSRF, and password change bugs, alongside a Postgres IPv6 connection fix.

This security update for Roundcube 1.5 fixes multiple vulnerabilities, including arbitrary file write, password change bugs, IMAP injection, and XSS issues.

Roundcube 1.7-rc4 fixes file permission issues during release builds and repairs a broken configuration download link in the installer.

Roundcube 1.7-rc3 fixes two security vulnerabilities, resolves various bugs, and introduces several configuration and feature enhancements.

Security update for Roundcube 1.6 fixing CSS injection, an SVG-based remote image blocking bypass, and a Managesieve date test issue.

Security update for Roundcube 1.5 LTS fixing CSS injection and remote image blocking bypass vulnerabilities.

This release candidate for version 1.7 addresses two security vulnerabilities and corrects a Postgres database migration syntax error.

Security update for Roundcube 1.6 addressing XSS and information disclosure vulnerabilities, alongside various bug fixes and PHP 8.5 compatibility improvements.

Security update for Roundcube 1.5 LTS fixing Cross-Site-Scripting and Information Disclosure vulnerabilities.

Roundcube 1.7 RC introduces a Markdown editor plugin, improved contact search and CSV import, and several security updates.

Roundcube 1.7 beta release adds PHP 8.5 support, IPv6 database DSN support, various security sanitization improvements, and drops support for Internet Explorer.

Beta release for version 1.7 introducing PHP 8.4 support, advanced mail search, and OAuth2 improvements, while requiring PHP 8.1+ and introducing several breaking changes.

This release fixes a PHP 5.5 compatibility issue introduced in version 1.5.10.

This security update for Roundcube 1.6 fixes a post-auth RCE vulnerability via PHP object deserialization and includes various bug fixes for OAuth, LDAP, and the UI.

Security update for Roundcube 1.5 fixing a post-auth RCE vulnerability and bugs related to managesieve_kolab_master and SVG images.

Stable update featuring IMAP extension support, OIDC token authentication improvements, and various bug fixes for PHP warnings, vCard handling, and database configurations.

This stable service release for version 1.6 fixes two regressions related to image attachment handling and HTML message styling.

This service release for version 1.5 fixes two regressions related to image attachment processing and HTML message styling.

This security update for Roundcube 1.6 fixes multiple XSS vulnerabilities, an information leak, and various bugs related to Sieve scripts and email attachments.

Security update for Roundcube 1.5 fixing XSS vulnerabilities and an information leak via CSS filtering.

This security update for Roundcube 1.6 fixes multiple XSS vulnerabilities, a command injection flaw on Windows, and various general bugs.

Security update for Roundcube 1.5 fixing XSS vulnerabilities, a Windows command injection flaw, and various bugs in Enigma and TinyMCE.

This service release for version 1.6 includes various bug fixes, PHP8 compatibility updates, and a security update for TinyMCE.

This security update for Roundcube 1.6 fixes a cross-site scripting (XSS) vulnerability related to attachment previews and downloads, along with several PHP errors and UI bugs.

This security update fixes a cross-site scripting (XSS) vulnerability related to attachment preview and download Content-Type/Content-Disposition settings.

Security update addressing a cross-site scripting (XSS) vulnerability in SVG handling, along with various PHP8, Windows, and Managesieve fixes.

Security update for Roundcube 1.5 that fixes a cross-site scripting (XSS) vulnerability related to SVG handling in HTML messages.

This security update for Roundcube Webmail 1.4 fixes a cross-site scripting (XSS) vulnerability in SVG handling and improves PHP 5.4 compatibility.

This security update fixes an XSS vulnerability in plain text linkrefs and addresses several bugs related to logging, vCard exports, date formatting, and JavaScript encoding.

This security update fixes a cross-site scripting (XSS) vulnerability in plain text message linkref handling and an Enigma private key synchronization issue.

This security update fixes a cross-site scripting (XSS) vulnerability and resolves multiple bugs, including regressions and PHP warnings.

This stable service release for version 1.6 includes numerous bug fixes, stability improvements, and the addition of Uyghur localization.

This service release for version 1.6 includes various bug fixes and improvements for PHP 8.1/8.2 compatibility, session handling, and general system stability.

Roundcube 1.6 introduces PHP 8.1 support, HTML response snippets, mail purging options, and updated service connection configurations, while dropping support for PHP versions below 7.3.

This release provides various bug fixes and improvements, specifically targeting PHP8 compatibility and Enigma PGP functionality.

Roundcube 1.6 release candidate includes jQuery-UI updates, ssha256 password support, and various bug fixes for attachments, encoding, and the HTML editor.

Roundcube 1.6 beta adds PHP 8.1 support, simplifies service connection configurations, and introduces HTML snippet support and improved mail purging options.

This service release provides various fixes for OAuth and other features, including a security fix for a cross-site scripting (XSS) vulnerability.

This security update fixes a cross-site scripting (XSS) vulnerability triggered by malicious CSS content in HTML messages.

This service release provides various small fixes and improvements following the 1.5.0 stable release.

This security update for Roundcube Webmail 1.4 fixes SQL injection and XSS vulnerabilities along with various bug fixes and general improvements.

Security update for LTS version 1.3 fixing XSS and SQL injection vulnerabilities.

Roundcube 1.5.0 introduces PHP 8.0 support, dark mode for Elastic skin, OAuth2 support, and full unicode support for MySQL databases.

Roundcube 1.5 release candidate introduces XOAUTH2 support for Managesieve, IMAP LITERAL- extension, RFC 2231 encoded names, and various bug fixes and security improvements.

Beta release of version 1.5 introducing PHP 8.0 support, OAuth2/XOauth, dark mode for Elastic skin, and full unicode support for MySQL.

This update addresses a stored XSS vulnerability in HTML messages and includes general stability and compatibility improvements.

This security update for Roundcube Webmail 1.4 fixes a stored XSS vulnerability (CVE-2020-35730) and includes several general bug fixes.

This security update for LTS version 1.3 fixes a stored cross-site scripting (XSS) vulnerability (CVE-2020-35730).

Security update for LTS version 1.2 fixing a stored cross-site scripting (XSS) vulnerability (CVE-2020-35730).

Roundcube Webmail 1.4 stable update featuring bug fixes for email composition, UI improvements for the Elastic skin, and an update to TinyMCE 4.9.11.

This service and security update for Roundcube 1.4 addresses several XSS vulnerabilities and includes various general bug fixes and improvements.

Security update for LTS version 1.3 fixing two cross-site scripting (XSS) vulnerabilities involving malicious SVG and MathML content in HTML messages.

Security update for LTS version 1.2 fixing two cross-site scripting (XSS) vulnerabilities involving malicious SVG and Math HTML content.

This service and security update fixes a cross-site scripting (XSS) vulnerability and includes various general bug fixes and improvements.

This security update for LTS version 1.3 fixes a cross-site scripting (XSS) vulnerability related to HTML messages with malicious svg/namespace (CVE-2020-15562).

This security update for LTS version 1.2 fixes a cross-site scripting (XSS) vulnerability involving malicious svg/namespaces (CVE-2020-15562).

Fixes a regression in the installer's SMTP test section.

This release fixes a regression in the installer's SMTP test section affecting new installations.

Service and security update for Roundcube 1.4 addressing multiple XSS vulnerabilities and providing general bug fixes and improvements.

Service and security update for Roundcube Webmail LTS 1.3 addressing four XSS vulnerabilities and including general improvements.

This security and service update addresses four security vulnerabilities, including XSS and remote code execution, alongside various general bug fixes and improvements.

Service and security update for Roundcube 1.3 LTS addressing four security vulnerabilities including XSS, CSRF, RCE, and path traversal, along with general bug fixes.

Security update for LTS version 1.2 fixing XSS, CSRF, remote code execution, and path traversal vulnerabilities.

Roundcube Webmail 1.4 stable update featuring general fixes and improvements for the Elastic theme and core plugins like Enigma, Managesieve, and Markasjunk.

This stable service release for Roundcube 1.4 includes various bug fixes and improvements across the Plugin API, Managesieve, installer, and UI components.

This service release for version 1.4 clarifies breaking changes regarding SMTP defaults and password charset while fixing several bugs and adjusting the 401 unauthorized status behavior.

Roundcube 1.4 introduces the responsive Elastic skin, mobile support, Redis and Memcached cache, and enhanced email features alongside numerous bug fixes and library updates.

This second release candidate for version 1.4 introduces the Elastic skin, jQuery 3.4.1, and numerous bug fixes and security improvements.

This service release for Roundcube Webmail 1.3 includes various bug fixes and security updates regarding CSS, HTML cleanup, and Enigma encryption.

This service release for Roundcube Webmail 1.3 includes various bug fixes backported from the master branch to improve stability and compatibility.

This release candidate for version 1.4 introduces the responsive Elastic skin, numerous password driver enhancements, and various bug fixes and plugin API updates.

Roundcube 1.3 service release providing a security fix for XSS and compatibility updates for PHP 7.3, MySQL 8, Courier-IMAP, and Dovecot.

Roundcube 1.4 beta introduces a new responsive Elastic skin, Redis cache support, SMTPUTF8, and various enhancements to Mailvelope and Managesieve integrations.

Service release updating Roundcube 1.3 with various bug fixes and a security mitigation for the EFAIL issue in OpenPGP.

Fixes a regression in IMAP command injection protection that disabled actions operating on all selected messages.

Fixes a regression in IMAP command injection protection that prevented actions from operating on all selected messages.

Security update fixing an IMAP command injection vulnerability (CVE-2018-9846) and an issue with remote content blocking in HTML messages.

Security update fixing an IMAP command injection vulnerability (CVE-2018-9846) and improving remote content blocking for HTML messages.

Security update fixing an IMAP command injection vulnerability (CVE-2018-9846) and providing PHP 7.2 compatibility and Enigma plugin improvements.

Service release for Roundcube 1.3 featuring various bug fixes, improved HTML editor font sizes, and a security fix for remote content blocking.

Service release for Roundcube 1.3 providing PHP 7.2 compatibility and various bug fixes across contacts, IMAP handling, and security.

Security update fixing a file disclosure vulnerability and improving mailto link decoding and non-ASCII character handling.

Security update for version 1.2 fixing a file disclosure vulnerability and several bugs related to message rendering and Managesieve parsing.

Security update for version 1.1 fixing a file disclosure vulnerability caused by insufficient input validation in file-based attachment plugins.

Security update for LTS version 1.0 that fixes a potential file disclosure vulnerability in file-based attachment plugins.

This service release for version 1.3 includes various bug fixes, translation updates, and a wording change for the 'mark as read' setting.

This service and security update for version 1.2 includes various bug fixes, UI improvements, and a fix for a potential XSS vulnerability.

This service release for version 1.3 includes bug fixes, a security patch for an XSS vulnerability, PHP optimizations, and UI improvements to the mailbox view and message list behavior.

Roundcube 1.3 introduces a three-column widescreen layout, WEBP and MathML support, and various plugin improvements, while dropping support for legacy browsers and PHP 5.3.