InfoSecBulletin Cybersecurity for mankind
Roundcube Webmail has given security updates for its 1.6 LTS and 1.7 branches. These updates fix 12 problems that could let users and servers face cross-site scripting, email header issues, data access from other users, remote content tricks, and attacks that misuse server requests.
The new versions, Roundcube 1.6.19 and 1.7.4, fix problems in how the open-source email platform handles email content, HTML, styles, attachment details, contact groups, and remote links. Admins using Roundcube 1.6.x or 1.7.x are advised to update soon.
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
WinRAR, WordPress RCE flaw & Zyxel GS1900 Zero-Day exploited in the wild
Daily Cyber security update for 04.11. 2026
Daily Cyber security update for 03.11. 2026
Using ARTEX AI, Hacker to attack 200 Organizations Across 14 Countries
Amadeus cyber incident impacted “Cathay Pacific, Qantas, Japan, Malaysia, Korean & Asiana” Airlines
One important flaw that was fixed is a zero-click stored cross-site scripting flaw. This involves adding TNEF MIME tags to attachment URLs. TNEF, which stands for Transport Neutral Encapsulation Format, is often linked to Microsoft Outlook attachments. An attacker might send a special email. This email could run harmful scripts when the victim opens the message, without needing the user to click a link or open an attachment.
The updates also solve another XSS flaw in Roundcube’s HTML editor for text/enriched emails. Cross-site scripting issues can let attackers run JavaScript in a victim’s webmail session. This can help them steal session tokens, change mailbox settings, read messages, or act as the logged-in user.
Some fixes solve flaws with email header injection. These issues involved the subject line, recipient name, and an organization’s field. Header injection vulnerabilities can be abused to manipulate email metadata or insert unexpected mail headers if malicious input is not correctly sanitized.
Roundcube fixed a flaw with user access in SQL address books. The issue allowed users to add or remove members from contact groups. It may let one user change another user’s group links in some situations. This problem can put contact privacy and address book data at risk in shared or hosted Roundcube settings.
Remote content protections got several fixes for issues like CSS smuggling, HTML body background property injecting, CSS-escape bypasses in FuncIRI attributes, and animation techniques in SVG SMIL that could get around remote content blocking.
Roundcube Webmail Patches 12 Security Flaws
The updates also fix a flaw with is_local_url() that allows some website addresses with a dot at the end to get through. Attackers could trick the system into thinking an outside resource is local and go around the rules.
A fix was made for a server-side request forgery flaw in the Roundcube CSS proxy. The issue was with hexadecimal IPv6-mapped IPv4 addresses. This could allow an attacker to skip address checks and make the server ask for private or limited network resources.
Roundcube stated that complete technical information can be found in the release notes for versions 1.6.19 and 1.7.4. The project highly advises all groups using affected Roundcube versions to update quickly.
