Security updates 1.7-rc5, 1.6.14 and 1.5.13 released

alecpl · alecpl · commit b2605e6e8f30 · 2026-03-18T15:28:11.000+01:00
diff --git a/_data/releases.json b/_data/releases.json
@@ -1,25 +1,25 @@
 {
     "stable": {
         "name": "Stable version",
-        "version": "1.6.13",
+        "version": "1.6.14",
         "sources": [
             {
                 "package": "Dependent",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcubemail-1.6.13.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcubemail-1.6.14.tar.gz",
                 "size": "3.7 MB",
-                "checksum": "1ee6a0877024b6ee73bda5050686487af7bc88301b2af3355a46c4ce8e327180"
+                "checksum": "70816db28bd7d5c16ba94e518a68368109542bf78bf3696e568385283c46027a"
             },
             {
                 "package": "Complete",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcubemail-1.6.13-complete.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcubemail-1.6.14-complete.tar.gz",
                 "size": "5.6 MB",
-                "checksum": "bdd1bafe79149a6b63f699fa94e7626189ec60e2c37954de7e84ee685dbbf5bb"
+                "checksum": "4c67510729c10bd30bd064e87ebaf3f9a2d26230804862430580260b86a01609"
             },
             {
                 "package": "Framework",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcube-framework-1.6.13.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcube-framework-1.6.14.tar.gz",
                 "size": "1.1 MB",
-                "checksum": "61a92c3152293f0e8401406e855a57ad8bea5b3f4b647565babe42658bbcddf8"
+                "checksum": "e35134263899c36ea9e981a9f9a5b6561dbcf59450f487dbca5196ffecb229b5"
             }
         ]
     },
@@ -33,34 +33,34 @@
         "name": "LTS versions",
         "sources": [
             {
-                "package": "1.5.13 - Complete",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.5.13/roundcubemail-1.5.13-complete.tar.gz",
+                "package": "1.5.14 - Complete",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.5.14/roundcubemail-1.5.14-complete.tar.gz",
                 "size": "7.2 MB",
-                "checksum": "37a8309882d782fa0b39d0f6e1efaa443b96e720e9e2c51106fb230926cca2f9"
+                "checksum": "c12dc9179c3ad6d3b3c4e7af080aef887cf9e4e6fb13b628343d135fcc8263a1"
             }
         ]
     },
     "beta": {
         "name": "Release candidate",
-        "version": "1.7-rc4",
+        "version": "1.7-rc5",
         "sources": [
             {
                 "package": "Dependent",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcubemail-1.7-rc4.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcubemail-1.7-rc5.tar.gz",
                 "size": "4.0 MB",
-                "checksum": "bf148cfd31195fec70e3f285221128a14ace619c61155c6c6f88d0d75edaf776"
+                "checksum": "33139a02828982b3359b73668ddcfb9b81e99a03b1864c94a14373770fe086c9"
             },
             {
                 "package": "Complete",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcubemail-1.7-rc4-complete.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcubemail-1.7-rc5-complete.tar.gz",
                 "size": "6.1 MB",
-                "checksum": "a2a5aa6e0be3a7ab2290f193f233560dd3ef183bd3cd52de415a7b7ac9b6cb1e"
+                "checksum": "2062e74731568f44e026d532794a53633ea85bd6b45a78e341fed9b33cda3590"
             },
             {
                 "package": "Framework",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcube-framework-1.7-rc4.tar.gz",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcube-framework-1.7-rc5.tar.gz",
                 "size": "1.1 MB",
-                "checksum": "9ee4f4d3ce39a72de9dc23aee57fe4579b9c20e37b1b8899df73340f49335697"
+                "checksum": "1192b7618fa9b63f340103a50c9828676f8ccc32ff72eefdc5328123fdf37512"
             }
         ]
     }
diff --git a/_posts/2026-03-18-security-updates-1.7-rc5-1.6.14-1.5.16.md b/_posts/2026-03-18-security-updates-1.7-rc5-1.6.14-1.5.16.md
@@ -0,0 +1,27 @@
+---
+layout: article
+title: Security updates 1.7-rc5, 1.6.14 and 1.5.13 released
+tags: releases updates security
+---
+
+We just published security updates to the 1.6 and 1.5 LTS versions of Roundcube Webmail, as well as a release candidate for coming 1.7.
+They contain fixes for recently reported set of security vulnerabilities.
+
+## Security fixes
+
+- Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us.
+- Fix bug where a password could get changed without providing the old password, reported by flydragon777.
+- Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team.
+- Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral.
+- Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral.
+- Fix fixed position mitigation bypass via use of !important, reported by nullcathedral.
+- Fix XSS issue in a HTML attachment preview, reported by aikido_security.
+- Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/.
+
+See the full changelogs in the release notes on the Github download pages for the updated versions
+
+- [1.7-rc5](https://github.com/roundcube/roundcubemail/releases/tag/1.7-rc5)
+- [1.6.14](https://github.com/roundcube/roundcubemail/releases/tag/1.6.14)
+- [1.5.14](https://github.com/roundcube/roundcubemail/releases/tag/1.5.14).
+
+We strongly recommend to update your productive installations of Roundcube with this new versions.

Original file line number	Diff line number	Diff line change
`@@ -1,25 +1,25 @@`
`1`	`1`	`{`
`2`	`2`	`"stable": {`
`3`	`3`	`"name": "Stable version",`
`4`		`- "version": "1.6.13",`
	`4`	`+ "version": "1.6.14",`
`5`	`5`	`"sources": [`
`6`	`6`	`{`
`7`	`7`	`"package": "Dependent",`
`8`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcubemail-1.6.13.tar.gz",`
	`8`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcubemail-1.6.14.tar.gz",`
`9`	`9`	`"size": "3.7 MB",`
`10`		`- "checksum": "1ee6a0877024b6ee73bda5050686487af7bc88301b2af3355a46c4ce8e327180"`
	`10`	`+ "checksum": "70816db28bd7d5c16ba94e518a68368109542bf78bf3696e568385283c46027a"`
`11`	`11`	`},`
`12`	`12`	`{`
`13`	`13`	`"package": "Complete",`
`14`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcubemail-1.6.13-complete.tar.gz",`
	`14`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcubemail-1.6.14-complete.tar.gz",`
`15`	`15`	`"size": "5.6 MB",`
`16`		`- "checksum": "bdd1bafe79149a6b63f699fa94e7626189ec60e2c37954de7e84ee685dbbf5bb"`
	`16`	`+ "checksum": "4c67510729c10bd30bd064e87ebaf3f9a2d26230804862430580260b86a01609"`
`17`	`17`	`},`
`18`	`18`	`{`
`19`	`19`	`"package": "Framework",`
`20`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.13/roundcube-framework-1.6.13.tar.gz",`
	`20`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.14/roundcube-framework-1.6.14.tar.gz",`
`21`	`21`	`"size": "1.1 MB",`
`22`		`- "checksum": "61a92c3152293f0e8401406e855a57ad8bea5b3f4b647565babe42658bbcddf8"`
	`22`	`+ "checksum": "e35134263899c36ea9e981a9f9a5b6561dbcf59450f487dbca5196ffecb229b5"`
`23`	`23`	`}`
`24`	`24`	`]`
`25`	`25`	`},`
`@@ -33,34 +33,34 @@`
`33`	`33`	`"name": "LTS versions",`
`34`	`34`	`"sources": [`
`35`	`35`	`{`
`36`		`- "package": "1.5.13 - Complete",`
`37`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.5.13/roundcubemail-1.5.13-complete.tar.gz",`
	`36`	`+ "package": "1.5.14 - Complete",`
	`37`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.5.14/roundcubemail-1.5.14-complete.tar.gz",`
`38`	`38`	`"size": "7.2 MB",`
`39`		`- "checksum": "37a8309882d782fa0b39d0f6e1efaa443b96e720e9e2c51106fb230926cca2f9"`
	`39`	`+ "checksum": "c12dc9179c3ad6d3b3c4e7af080aef887cf9e4e6fb13b628343d135fcc8263a1"`
`40`	`40`	`}`
`41`	`41`	`]`
`42`	`42`	`},`
`43`	`43`	`"beta": {`
`44`	`44`	`"name": "Release candidate",`
`45`		`- "version": "1.7-rc4",`
	`45`	`+ "version": "1.7-rc5",`
`46`	`46`	`"sources": [`
`47`	`47`	`{`
`48`	`48`	`"package": "Dependent",`
`49`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcubemail-1.7-rc4.tar.gz",`
	`49`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcubemail-1.7-rc5.tar.gz",`
`50`	`50`	`"size": "4.0 MB",`
`51`		`- "checksum": "bf148cfd31195fec70e3f285221128a14ace619c61155c6c6f88d0d75edaf776"`
	`51`	`+ "checksum": "33139a02828982b3359b73668ddcfb9b81e99a03b1864c94a14373770fe086c9"`
`52`	`52`	`},`
`53`	`53`	`{`
`54`	`54`	`"package": "Complete",`
`55`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcubemail-1.7-rc4-complete.tar.gz",`
	`55`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcubemail-1.7-rc5-complete.tar.gz",`
`56`	`56`	`"size": "6.1 MB",`
`57`		`- "checksum": "a2a5aa6e0be3a7ab2290f193f233560dd3ef183bd3cd52de415a7b7ac9b6cb1e"`
	`57`	`+ "checksum": "2062e74731568f44e026d532794a53633ea85bd6b45a78e341fed9b33cda3590"`
`58`	`58`	`},`
`59`	`59`	`{`
`60`	`60`	`"package": "Framework",`
`61`		`- "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc4/roundcube-framework-1.7-rc4.tar.gz",`
	`61`	`+ "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7-rc5/roundcube-framework-1.7-rc5.tar.gz",`
`62`	`62`	`"size": "1.1 MB",`
`63`		`- "checksum": "9ee4f4d3ce39a72de9dc23aee57fe4579b9c20e37b1b8899df73340f49335697"`
	`63`	`+ "checksum": "1192b7618fa9b63f340103a50c9828676f8ccc32ff72eefdc5328123fdf37512"`
`64`	`64`	`}`
`65`	`65`	`]`
`66`	`66`	`}`