What was released, and what to remember
On 19 October 2026 the Roundcube project announced a security update for both maintained branches: 1.6 (LTS) moves to 1.6.20 and 1.7 moves to 1.7.5. The announcement recommends updating every production installation and offers no workaround. The release notes ask you to back up your data before updating.
Roundcube's announcement lists no CVE identifier. Debian published advisory DSA-6579-1 on 23 October 2026, which groups 20 CVEs without mapping them one by one to the fixes. Third-party sites disagree on these identifiers, so this guide cites none and points to the primary sources listed at the end.
The classes of flaws fixed
- IMAP command injection — a line break slipped into the
_uidparameter (headers and view-source actions) or_flag(mark action) allowed commands to be injected towards the IMAP server. - Message header injection — sender name in the resend action,
References,In-Reply-ToandMessage-IDheaders, subject of a message forwarded as an attachment, media type of an inline image. - Session object injection — session deserialization accepted keys prefixed with an exclamation mark.
- XSS — the error response from a password-change driver was mishandled on display.
- Remote-content blocking bypasses — the SVG SMIL
byattribute, CSS escape sequences, CSS scoping bypassed through at-rules. - SSRF and bypassed settings — the local-address filter ignored the NAT64 range
64:ff9b::/96, and old action aliases escaped thedisabled_actionssetting. - Drivers and imports — the Modoboa password driver could change another account's password, and the SquirrelMail import used an unsanitized login name in a file path.
Which version to target for your installation
Scroll the table
| Installation | Fixed version | What to remember |
|---|---|---|
| Roundcube 1.6.x (official archive) | 1.6.20 | LTS branch: stay on 1.6 and move to 1.6.20 |
| Roundcube 1.7.x (official archive) | 1.7.5 | Move to 1.7.5 without changing branch |
| Debian 13 (trixie) | 1.6.20+dfsg-0+deb13u1 | Package version quoted by advisory DSA-6579-1 |
| Other Debian releases | See the Debian advisory and security tracker | The advisory lists only trixie: read the package tracker for your release |
| Webmail provided by cPanel | Depends on the panel update | Follows cPanel updates: no resumption date is claimed here |
| Other panel or distribution | Depends on the vendor | Read the package changelog, not just the number |
Why the version number is not enough
A webmail is installed in one of three ways: from the official archive copied by hand, from the distribution package, or through the hosting panel. Each is updated differently, and the last two carry a trap: the fix may be backported into an older version whose number does not change, or may not have been picked up yet.
An agency managing dozens of accounts therefore deals with several sources of truth. Before updating, you need an inventory: for each client, where the webmail is installed, through which channel it is delivered, and which version it really displays.
Inventory Roundcube versions
List servers and the delivery channel
Note for each server whether Roundcube comes from the distribution package, an archive dropped by hand or the hosting panel. This channel decides the update method.
Read the version of a Debian or Ubuntu package
On a machine using the distribution package:
dpkg -l roundcube-coregives the installed version, andapt-cache policy roundcube-coreshows the candidate version in your repositories.Read the package changelog
On Debian the number can stay the same when a fix is backported. Read the package changelog with
apt changelog roundcube-coreand look for a mention of advisory DSA-6579-1, rather than trusting the displayed version alone.Record the version of a manual installation
For an archive installed by hand, the version is visible in Roundcube's interface, in the application information. Record it in your tracking table together with the installation directory path, which you will reuse in the update step.
Record the result per client
One line per account: server, channel, version found, target version, date of update. This table becomes the proof that the fix was applied everywhere, and the follow-up list for accounts that lag behind.
Update according to the delivery channel
The rule is the same for every channel: target 1.6.20 for the 1.6 branch and 1.7.5 for the 1.7 branch, after a backup. For a distribution package, the update goes through the package manager. For an official archive, it goes through the installto.sh script shipped with Roundcube. For a webmail provided by a panel, the update follows the panel's own.
Update an installation
Back up the directory and the database
Copy the Roundcube directory and export the database (schema and data) to a safe place. The release notes explicitly ask for this backup before any update.
Debian or Ubuntu package
Run
apt update, thenapt install --only-upgrade roundcube-core. Then check the version withdpkg -l roundcube-coreand the package changelog.Official archive: download the release
Download the archive of the target version from the Roundcube download page, then unpack it in a working directory outside the production installation.
Official archive: run the update script
From the unpacked directory, run
bin/installto.shgiving it the directory of the existing installation. The script first copies the updated files, then runs the update script, which migrates local configuration and updates the database schema if needed.Install dependencies if needed
If you did not download the so-called complete archive, the documentation asks you to run
php composer.phar install --no-devin the installation directory with Composer 1.1.0 or higher.Apply the database manually if needed
If the schema was not migrated by the script,
bin/updatedb.shapplies the database changes. Read the manual update section of Roundcube's UPGRADING file before running it.Webmail provided by cPanel
The webmail is delivered by the panel: its update follows cPanel's. No resumption date for this fix is claimed here. For a client, read the version in Roundcube's interface, in the application information, after each panel update, and record it in the tracking table. If the displayed version is not a fixed one, report it to the host's support.
Check that the fix is really in place
An update that raises no error is not a verified update. Check the displayed version, which must match 1.6.20 or 1.7.5 for an archive, or the package number for a distribution. On Debian, also check that the package changelog mentions advisory DSA-6579-1.
Then test a full cycle on a test account: login, reading a message, sending, replying, marking. Finally go through the webmail and web server error logs: an error appearing right after the version change usually points to a plugin or configuration file to migrate.
Lasting hardening, not presented as a workaround
These measures do not replace the update: they reduce the surface for the next ones. Disable unused plugins, in particular the password-change plugin (password) when clients have no use for it, since two of the fixed flaws touched its drivers. Limit webmail exposure to what is needed, and keep web server and Roundcube logs.
Looking for traces of exploitation
Injection flaws are triggered by requests where a parameter contains a line break. As a hint, search the web server logs for webmail requests whose _uid or _flag parameters contain encoded line breaks (%0d%0a), and look for unusual outgoing messages from the mailboxes concerned. The absence of traces is not proof: logs only cover what they record. Update first, investigate afterwards if a client account shows abnormal behavior.
The official documentation
The facts in this guide come from primary sources, to be read before acting: Roundcube's announcement at https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5, the 1.6.20 release notes at https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 and 1.7.5 at https://github.com/roundcube/roundcubemail/releases/tag/1.7.5, Debian advisory DSA-6579-1 at https://lists.debian.org/debian-security-announce/2026/msg00495.html, and the update procedure at https://github.com/roundcube/roundcubemail/wiki/Upgrade.
