The Roundcube project shipped security updates 1.7.5 and 1.6.20 (1.6 LTS) on Oct 19. Each fixes 20 reported issues and the project recommends updating all production installs. Highlights from the release notes:

• IMAP command injection via CRLF in the _uid parameter (mail/headers and mail/viewsource) and in the _flag parameter (mail/mark).
• Object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys.
• CSRF validation bypass in the mark-as-junk action, and deprecated action aliases that bypassed disabled_actions.
• Unsafe attachment content passed to ImageMagick on resize, plus an ImageMagick resource-limit bypass through the GD fallback.
• SSRF filter bypass via NAT64 (64:ff9b::/96), remote-content-blocking bypasses (SVG SMIL, CSS escapes), CSS scoping bypass in HTML mail.
• Several mail-header injections, XSS in password-driver error responses, the Modoboa password driver able to change another account's password, and an unsafe login-name path in SquirrelMail import.

The notes give no CVE IDs or severity scores, and no exploitation has been reported. Roundcube has a long record of being exploited by state actors (APT28 and Winter Vivern have both used Roundcube XSS bugs), and several of these flaws can be chained with message-borne input. Do now: update to 1.7.5 or 1.6.20. If you run 1.5.x, note this round shipped no 1.5 release, so plan the move to 1.6/1.7. If you can't patch today, disable the password plugin's Modoboa driver and the markasjunk plugin, and put the webmail behind SSO or a VPN.