---
title: Roundcube 1.7.5 and 1.6.20 fix 20 security bugs, including two IMAP command injections via CRLF, a session unserialize object-injection primitive and a CSRF bypass; webmail admins should update | ctxsec
url: https://ctxsec.com/items/roundcube-1-7-5-1-6-20-security-oct-2026
description: ""
status: "confirmed (Roundcube release notes, Oct 19); no CVE IDs or exploitation reported yet"
published: 2026-10-20
---

> 

[← Cybersecurity News](/news) · [markdown](/items/roundcube-1-7-5-1-6-20-security-oct-2026.md)

confirmed (Roundcube release notes, Oct 19); no CVE IDs or exploitation reported yet

2026-10-20

### Roundcube 1.7.5 and 1.6.20 fix 20 security bugs, including two IMAP command injections via CRLF, a session unserialize object-injection primitive and a CSRF bypass; webmail admins should update

The Roundcube project shipped security updates **1.7.5** and **1.6.20** (1.6 LTS) on **Oct 19**. Each fixes 20 reported issues and the project recommends updating all production installs. Highlights from the release notes:

- **IMAP command injection** via CRLF in the `_uid` parameter (mail/headers and mail/viewsource) and in the `_flag` parameter (mail/mark).
- **Object injection primitive** in `rcube_session::unserialize()` via "!"-prefixed session keys.
- **CSRF validation bypass** in the mark-as-junk action, and deprecated action aliases that bypassed `disabled_actions`.
- Unsafe attachment content passed to **ImageMagick** on resize, plus an ImageMagick resource-limit bypass through the GD fallback.
- SSRF filter bypass via NAT64 (`64:ff9b::/96`), remote-content-blocking bypasses (SVG SMIL, CSS escapes), CSS scoping bypass in HTML mail.
- Several mail-header injections, XSS in password-driver error responses, the **Modoboa password driver** able to change another account's password, and an unsafe login-name path in SquirrelMail import.

The notes give no CVE IDs or severity scores, and no exploitation has been reported. Roundcube has a long record of being exploited by state actors (APT28 and Winter Vivern have both used Roundcube XSS bugs), and several of these flaws can be chained with message-borne input. **Do now:** update to 1.7.5 or 1.6.20. If you run 1.5.x, note this round shipped no 1.5 release, so plan the move to 1.6/1.7. If you can't patch today, disable the password plugin's Modoboa driver and the markasjunk plugin, and put the webmail behind SSO or a VPN.

Sources: [Roundcube news: security updates 1.6.20 and 1.7.5](https://roundcube.net/news/) · [GitHub release 1.7.5](https://github.com/roundcube/roundcubemail/releases/tag/1.7.5) · [GitHub release 1.6.20](https://github.com/roundcube/roundcubemail/releases/tag/1.6.20)