Home / Blog / Technology

Roundcube 1.6.20 and 1.7.5: 20 Security Fixes for Your Webmail

Roundcube released security updates on 19 October 2026. If your hosting or mail server runs Roundcube webmail, here is how to check and update.

By Susraj Tech team23 October 20262 min read

Roundcube 1.6.20 and 1.7.5: 20 Security Fixes for Your Webmail

Quick answer

Roundcube released versions 1.6.20 and 1.7.5 on 19 October 2026, fixing around twenty security issues including IMAP command injection, mail header injection, a remote content blocking bypass and an SSRF filter bypass. The project strongly recommends updating all production installs of the 1.6 and 1.7 lines. If you use Roundcube through cPanel, Plesk or a hosting provider, ask whether it has been updated. The Hacker News reports no evidence of exploitation.

Roundcube is the open source webmail that many hosting panels ship by default. If your company email is read in a browser on a cPanel, Plesk or similar host, you are probably using it, even if nobody on your team ever installed it.

On 19 October 2026 the Roundcube project released 1.6.20 (the 1.6 long-term line) and 1.7.5, and said they fix recently reported security vulnerabilities. It strongly recommends updating all production installations.

What was fixed

The release notes list about twenty items. The ones that matter most to a small business reading mail in a browser:

IMAP command injection through parameters of the headers, view source and mark actions.
Mail header injection in several places, including the Bounce (resend) action and forwarded messages.
Bypasses of remote content blocking, the feature that stops tracking images and external content loading in a received email.
An SSRF filter bypass and a missing size limit in the CSS proxy.
An XSS issue in handling error responses from password drivers.
Unsafe attachment content being passed to ImageMagick when resizing images.
A session handling fix involving object injection through certain session keys.

We are summarising, not explaining how to abuse any of these. Read Roundcube's own notice for the full list and credits. The Hacker News says there is no evidence any of the vulnerabilities have been exploited.

What to do

Find out who runs it. Self-hosted install, or provided by your host or control panel?
Check the version. You want 1.6.20 or 1.7.5 or later. Older 1.6.x and 1.7.x releases lack these fixes.
Ask your host. A Plesk forum thread shows customers asking exactly when their panel will ship 1.6.20, so providers may be a few days behind. Ask for a date.
Update self-hosted installs by following Roundcube's upgrade instructions, back up the database and config first, and test login, sending and attachments afterwards.
Keep remote content blocking on for staff mailboxes and remind people not to open unexpected attachments.
Turn on two-factor sign-in where your mail setup supports it, and review forwarding rules on mailboxes you do not recognise.

Mail is where account resets, invoices and customer data land, so it deserves the same routine as the website. Our website maintenance guide shows how to schedule it. If you want us to check your hosting and mail setup, contact Susraj Tech.

Frequently asked questions

Is Roundcube being exploited?

The Hacker News reports no evidence of exploitation of these fixes so far.

I use a hosting provider. What should I do?

Ask them which Roundcube version is installed and when 1.6.20 or 1.7.5 will be live.

Sources

Last reviewed 23 October 2026. This is general security information, not a guarantee of protection.

Frequently asked questions

What did Roundcube release?

Roundcube published security updates 1.6.20 for the 1.6 LTS line and 1.7.5 for the 1.7 line on 19 October 2026. Both contain fixes for recently reported vulnerabilities.

What kinds of issues were fixed?

The release notes list IMAP command injection, mail header injection, bypasses of remote content blocking, an SSRF filter bypass, an XSS issue in password driver error handling, unsafe attachment handling during image resize, and more.

Is Roundcube being exploited?

The Hacker News says there is no evidence any of the patched vulnerabilities have been exploited. Roundcube issues security releases regularly, so keeping current matters more than any single bug.

I do not run Roundcube myself. Do I need to act?

If your email is on shared hosting, cPanel, Plesk or a similar panel, the host usually installs Roundcube. Ask your provider whether it has moved to 1.6.20 or 1.7.5.

How do I check my version?

In Roundcube, open Settings and look for the About section, or check the version file in your install. Hosting panels also list the installed webmail version.

Written by the Susraj Tech team

We design and build websites, mobile apps, SaaS products and AI solutions. Have a project in mind? Tell us about it and we’ll send a clear, written quote.