Roundcube has released version 1.7.2, a security-focused update addressing six vulnerabilities, including two CVE-tracked flaws that could allow attackers to execute stored cross-site scripting (XSS) without any user interaction.
Maintainer alecpl pushed the release five days ago, urging all production deployments to update immediately after backing up data. The most severe issue, tracked as CVE-2026-54433, is a zero-click stored XSS vulnerability in Roundcube’s plain-text rendering engine.
An attacker can embed malicious payloads in plain-text emails that execute automatically when a victim simply views the message no clicks, links, or attachments required.
Roundcube Webmail Flaws
This class of vulnerability is particularly dangerous for webmail platforms because it bypasses typical user-awareness defenses, such as avoiding suspicious links.
A related flaw, CVE-2026-54432, involves stored XSS via an unescaped attachment MIME type displayed on the attachment-validation warning page.
Both CVEs were reported by Bohdan Kurinnoy of Samsung R&D Institute Ukraine (SRUKR), highlighting a pattern of insufficient output sanitization in Roundcube’s rendering pipeline.
Researcher Leenear identified two new bypass techniques for Roundcube’s Server-Side Request Forgery (SSRF) protections that involve specially crafted local-address URLs.
SSRF flaws typically let attackers coerce the server into making unauthorized internal network requests, potentially exposing internal services or metadata endpoints.
This marks at least the second round of SSRF bypass fixes in Roundcube’s local-address filtering logic, suggesting that the underlying validation approach may require an architectural review rather than incremental patching.
Separately, Glendaenri and peppersghost reported multiple vulnerabilities in the password plugin tied to session-injected usernames, which could allow manipulation of password-change requests using attacker-controlled session data.
Two DoS-related bugs affect Roundcube’s TNEF (winmail.dat) decoder, used to parse Microsoft Outlook’s proprietary attachment format:
- An infinite loop condition (issue #10193, reported by stafra) that could hang server resources when processing malformed TNEF files.
- A crafted compressed-RTF size field within TNEF attachments (reported by h0rk1p) that could trigger resource exhaustion during decompression.
Both flaws share a common attack vector: malicious email attachments designed to exploit parsing logic rather than deliver traditional malware payloads.
Beyond security patches, version 1.7.2 includes several bug fixes: a HEAD request handler added to static.php, corrected OAuth password-claim retrieval logic, resolution of a 416 error on ranged requests, and fixes for skin logo loading failures.
The update also addresses improper vCard 2.1 line unfolding during contact imports and resolves temporary file leakage in Imagick on failure.
Mitigation
Given the zero-click nature of CVE-2026-54433, according to Roundcube advisory, organizations running Roundcube should prioritize this update over routine patch cycles.
Administrators managing multi-tenant or high-visibility webmail deployments face elevated risk, since a single malicious email could compromise sessions across an organization without any interaction from the victim.
As always, back up configuration and database files before upgrading, and verify plugin compatibility, particularly for the password plugin, given the session-handling changes in this release.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
