Roundcube webmail, already targeted by Russian hackers, patches 20 vulnerabilities at once

Twenty vulnerabilities fixed at once. On October 19, the Roundcube team released versions 1.6.20 and 1.7.5 of its open-source webmail, the one the cPanel hosting panel has offered by default since 2008, according to BleepingComputer. It strongly recommends updating all production installations.

The same day, CERT-FR (France's government computer emergency response team) published an advisory on these flaws. Among the risks, it lists remote arbitrary code execution, security policy bypass, server-side request forgery (SSRF), cross-site scripting (XSS) and cross-site request forgery (CSRF). Affected versions: all those prior to 1.6.20, and the 1.7 branch before 1.7.5.

From hijacked IMAP requests to booby-trapped images

The Roundcube bulletin gives neither a severity score nor a CVE identifier. It describes flaws of very varied kinds, reported by about a dozen researchers:

• two IMAP command injections (IMAP is the protocol that connects the webmail to the mail server) through poorly filtered parameters;
• an object injection when reading session data;
• potentially dangerous attachments passed to ImageMagick, the tool used to resize images;
• several ways to bypass the blocking of remote content and the filter against requests to the internal network;
• message header injections, an XSS flaw and a bypass of CSRF protection;
• a flaw in the password change plugin for Modoboa, which could allow changing another account's password.

Neither Roundcube nor CERT-FR reports any exploitation at this stage.

Why you shouldn't wait

Roundcube is a known target. In February 2026, the CISA, the US cybersecurity agency, added two of the webmail's vulnerabilities to its catalog of exploited flaws. One of them, CVE-2025-49113, a critical code execution flaw, was exploited just days after its June 2025 patch, BleepingComputer reports. The same outlet recalls that the Russian group Winter Vivern exploited a Roundcube flaw against European governments, and that the Russian espionage group APT28 used one against Ukrainian government mail servers.

The October 19 fixes are now visible in the project's public source code. For an attacker, that is a lead for finding the flaws on servers that have not yet been updated.

What to do

• Update to 1.6.20 (1.6 branch) or 1.7.5 (1.7 branch), following the release notes published on GitHub.
• If your webmail is provided by a hosting company or a panel such as cPanel, ask them when the update will be applied.
• If you use the password plugin for Modoboa, treat that server as a priority.
• Check that older versions, still present on forgotten servers, are removed or updated.

It remains to be seen whether some of these flaws will receive a CVE identifier and a severity score. That would make things easier for teams that have to decide where to start.