Roundcube: the update belongs on the server
CERT-FR reports several Roundcube Webmail vulnerabilities. The affected branches need updates to 1.6.20 or 1.7.5, depending on the installation. If your hosting provider runs the webmail, ask it to confirm the fix.
Getting started
Generated image · SecuFocus
At a glance
Key points
Do you administer Roundcube? Check the server version: CERT-FR lists releases before 1.6.20 and the 1.7 branch before 1.7.5. If you only use your provider’s webmail, ask whether it has applied the update. Switching browsers does not patch the server.
Check the installed branch
CERT-FR advisory CERTFR-2026-AVI-1340, published on October 19, reports several Roundcube Webmail vulnerabilities. It lists releases before 1.6.20 and versions in the 1.7.x branch before 1.7.5. For the 1.6 branch, the update to check is 1.6.20; for 1.7, it is 1.7.5.
Some of the flaws can allow remote code execution, requests sent by the server to an attacker-chosen destination (SSRF), or script injection into a page (XSS). The advisory does not establish that every listed consequence affects every configuration.
On Debian 13, check the distribution package
On 23 October, Debian adds DSA-6579-1. Its tracker lists roundcube 1.6.18+dfsg-0+deb13u1 as vulnerable on trixie and 1.6.20+dfsg-0+deb13u1 as fixed in trixie-security. For a Debian 13 package installation, compare the complete package version and apply the distribution’s security update rather than replacing files with an upstream archive.
Who can apply the fix?
If you run the server, identify its installed version and distribution method, then prepare the update for that branch. Keep a usable backup of the configuration and data your installation needs. Afterwards, check sign-in, sending a message and opening a harmless attachment.
If Roundcube comes with your hosting plan, ask the provider whether it has addressed CERTFR-2026-AVI-1340. You do not need to install a program delivered by email to patch this webmail. Updating your browser or changing your password does not replace the server fix.
What the advisory does not establish
The advisory we read does not confirm active exploitation or detail each flaw’s prerequisites. We are not describing every Roundcube installation as already compromised. The practical check is to have whoever maintains the server confirm that the fix is in place.
This article draws on CERT-FR and Debian’s security tracker. SecuFocus has neither installed these versions nor reproduced an attack. The Roundcube bulletin linked by CERT-FR was not used directly because it is outside our authorised news-source list.
Check and explore
Sources for this article
Numbers connect each reference to the passages that use it. Dates show when the documentation was consulted.
- Debian Security Tracker: DSA-6579-1, Roundcube for trixie ↗security-tracker.debian.org ·
This article draws on the sources above. The exercises are for you to try on your devices; SecuFocus does not present them as tests carried out by its editorial team. Interfaces and features can change. Method and corrections.
Cite this article
Keep this reference with the article when you save or share it.