Roundcube published security updates 1.6.20 (1.6 LTS) and 1.7.5 on 19 October 2026 and says it strongly recommends updating all production installations of 1.6.x and 1.7.x.

The release notes list about 20 security fixes. The first to get a CVE record, CVE-2026-113386 (published 20 October, CVSS 3.1 score 7.1), lets a logged-in user inject CRLF sequences into the _uid parameter of the mail/headers and mail/viewsource actions to run arbitrary IMAP commands; a similar IMAP injection through the _flag parameter of mail/mark is also fixed. Other fixes cover mail header injection in the bounce (resend), forward-as-attachment and reply paths, an XSS in password driver error responses, a CSRF check bypass in mark-as-junk, an SSRF filter bypass using NAT64 addresses, remote-content blocking bypasses via SVG and CSS, unsafe attachment content passed to ImageMagick during image resizing, an object injection primitive in session handling, deprecated action aliases that ignored the disabled_actions setting, and a Modoboa password driver bug that could change another account's password.

Roundcube has not said any of these are being exploited, but earlier Roundcube flaws have been exploited in the wild, so patch promptly. Primary: Roundcube.

UPDATE (22 Oct 2026): MITRE published 19 further CVE records for the fixes in 1.6.20 and 1.7.5 on 22 October (CVE-2026-114714 to CVE-2026-114732), with CVSS 3.1 scores from 3.1 to 8.5; the highest is CVE-2026-114716, a mail header injection (8.5), followed by CVE-2026-114727, unsafe content passed to ImageMagick (8.3). (source: CVE records at cve.org, scored by MITRE)