Fabre

#1151279 roundcube: Multiple security vulnerabilities #1151279

Package:: src:roundcube

Source:: src:roundcube

Submitter:: Guilhem Moulin

Date:: 2026-10-22 09:11:01 UTC

Severity:: normal

Tags:

#1151279#5

Date:: 2026-10-19 14:22:07 UTC

From:

To:

Source: roundcube
Version: 1.6.19+dfsg-1
Control: found -1 1.6.19+dfsg-0+deb13u1
Control: found -1 1.6.5+dfsg-1+deb12u12
Severity: important
Tags: security upstream
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Roundcube webmail upstream has just released 1.6.20 [0] which fixes a
new batch of security vulnerabilities:

  * Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource
    action
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
  * Fix bug where an alias login wasn’t qualified by IMAP host
https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
  * Add a size limit to the CSS proxy content processing
https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
  * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
  * Fix remote content blocking bypass via SVG SMIL by attribute
https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
  * Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
  * Fix passing potentally unsafe attachment content into ImageMagick on image resize
https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
  * Fix mail header injection via the From display-name in the Bounce (resend) action
https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
  * Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
  * Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session
    keys
https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
  * Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
  * Fix CSS scoping bypass in HTML messages using at-rules
https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
  * Fix bug where deprecated action aliases bypassed disabled_actions setting
https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
  * Fix IMAP command injection via CRLF in _flag parameter of mail/mark action
https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
  * Fix CSRF validation bypass in the mark-as-junk action
https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
  * Fix XSS issue in handling of password driver error responses
https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
  * Fix mail header injection via subject of a message forwarded as attachment
https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
  * Fix mail header injection via media type in an inline image data URI
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
  * Fix bug where Password Modoboa driver could change password for another account
https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
  * Fix unsafe use of a login name in SquirrelMail import file path
https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6

AFAIK no CVE-ID have been published for these issues.  I'm quite busy this week and will
probably not find time to file MITRE's form before the week-end.

#1151279#14

Date:: 2026-10-19 15:38:58 UTC

From:

To:

I can help out with filing for CVE ID's, if no objection.

Kind regards,

     Edmund

#1151279#19

Date:: 2026-10-19 15:38:58 UTC

From:

To:

I can help out with filing for CVE ID's, if no objection.

Kind regards,

     Edmund

#1151279#24

Date:: 2026-10-19 15:40:12 UTC

From:

To:

Go ahead, thanks!

#1151279#29

Date:: 2026-10-19 16:19:25 UTC

From:

To:

We believe that the bug you reported is fixed in the latest version of
roundcube, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1151279@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Guilhem Moulin <guilhem@debian.org> (supplier of updated roundcube package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Mon, 19 Oct 2026 16:51:01 +0200
Source: roundcube
Architecture: source
Version: 1.6.20+dfsg-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Roundcube Maintainers <pkg-roundcube-maintainers@alioth-lists.debian.net>
Changed-By: Guilhem Moulin <guilhem@debian.org>
Closes: 1151279
Changes:
 roundcube (1.6.20+dfsg-1) unstable; urgency=medium
 .
   * New upstream security and bugfix release (closes: #1151279).
     + Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers
       and mail/viewsource action.
     + Fix bug where an alias login wasn't qualified by IMAP host.
     + Add a size limit to the CSS proxy content processing.
     + Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96.
     + Fix remote content blocking bypass via SVG SMIL `by` attribute.
     + Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
       (again).
     + Fix passing potentially unsafe attachment content into ImageMagick on
       image resize.
     + Fix mail header injection via the From display-name in the Bounce (resend)
       action.
     + Fix mail header injection via References/In-Reply-To/Message-ID/From
       parameters.
     + Fix object injection primitive in rcube_session::unserialize() via
       “!”-prefixed session keys.
     + Fix ImageMagick resource limits bypass by GD fallback during thumbnail
       generation.
     + Fix CSS scoping bypass in HTML messages using at-rules.
     + Fix bug where deprecated action aliases bypassed `disabled_actions`
       setting.
     + Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark
       action.
     + Fix CSRF validation bypass in the mark-as-junk action.
     + Fix XSS issue in handling of password driver error responses.
     + Fix mail header injection via subject of a message forwarded as
       attachment.
     + Fix mail header injection via media type in an inline image data URI.
     + Fix bug where Password Modoboa driver could change password for another
       account.
     + Fix unsafe use of a login name in SquirrelMail import file path.
   * Remove `Depends: ${misc:Depends}` from the binary packages.
   * Refresh d/roundcube-core.lintian-overrides.
Checksums-Sha1:
 15788fa9018782f7800dd4e7c280a22f82d2f4cf 3845 roundcube_1.6.20+dfsg-1.dsc
 32a740c50ee6ae83c79d675e539d9bb4ff86ca19 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c17351cead238baa4a63bce2b136ff054c2034f9 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 d6cb3e64e6cef16458b627130240c0e7e88b7536 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 12748f310f554dda71c7ff9eb85ee3c8fd57c223 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz
 d5074c57b5ce2b37285b8d638a43fac0b0679d71 6606 roundcube_1.6.20+dfsg-1_source.buildinfo
Checksums-Sha256:
 ad49d6e2c5b2456fd1181965d6e2d95b791550fb1fd49f5a8594c5b7db0f0286 3845 roundcube_1.6.20+dfsg-1.dsc
 b7968a5dd8a32fdbde4afd733111a6fd44cbfa346332bd07e4dcf2c5b09007cf 126856 roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 5f0d2f90355cd16d94d6be3e857995be0c4bad6b96cde894815901577eba5c34 1928744 roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 fa1b308c9e3169776321b80af6f1831329b1947a515a024fe9032e31055c3b39 2921204 roundcube_1.6.20+dfsg.orig.tar.xz
 67eb7e731cd90162e0c4e094c6479ffc58c78b3482452c50e7ed194a5e957b7f 160736 roundcube_1.6.20+dfsg-1.debian.tar.xz
 9983c4c0dceb08ac00793e7647c0260c2d85681693ad48f776404b6bde523e44 6606 roundcube_1.6.20+dfsg-1_source.buildinfo
Files:
 2b50841dc93f7b8d5f4e129b8816c61c 3845 web optional roundcube_1.6.20+dfsg-1.dsc
 9f448ec4c449b2c7a9af1544112ef559 126856 web optional roundcube_1.6.20+dfsg.orig-tinymce-langs.tar.xz
 c7276aef6d00b70deda0abf66bc2e050 1928744 web optional roundcube_1.6.20+dfsg.orig-tinymce.tar.xz
 a7ab89080eb8e14bc5433bbd30b05120 2921204 web optional roundcube_1.6.20+dfsg.orig.tar.xz
 4b02718efe18e2ffffbe2193f630da79 160736 web optional roundcube_1.6.20+dfsg-1.debian.tar.xz
 c94235c8487a69860e3762d710f6a96e 6606 web optional roundcube_1.6.20+dfsg-1_source.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIyBAEBCgAdFiEERpy6p3b9sfzUdbME05pJnDwhpVIFAmrWPoEACgkQ05pJnDwh
pVI7Ug/4zojdCk8ECAJ0ebvX7Rq6bCzGvUF/05TZnw+VlFnTrDnB1lUrR4eK8SPG
Fn+6Vg8DzyqFdl5wsb4QGCdjGhzKdOOGW9QifKa2lbkN6fGbYIM4Q8CEDMr3jn1g
aUbYzl94LA1MBdpr+SZrq1U8TpnR2r9NHvP7OckqRR8gN7SjdS37PiH36+8DsC5I
58YQm4jgH1NekIBRlFbysicyuHJMqe3KbEI1rZQ+s2QS0fDFyokfond9PGj1CP9e
J7pH5/0yU2OJS0Yw1GErqbt7Z1rW4hNXCujmSORT2UYQ2sAuKX3SdKbvvUQMPZZN
l68u9T06OjDxEZQVVRucRQkUDROp4t98vA6r+uVnHlfOV4L0NwpKyIYdhc5i64j4
Ph8Z7ViDgn022QbZNfaX9sWEUO7du/lPU03eFBjYKXU74UdDEvlZp5HE280W/uJd
lUaWveT1dpMRo4SiLRDbelVSfvbzeguc2el7UKMpIj7H/vk2txyMY5AKz/FboQEE
E5YxkUJ+ncuc4qPzQsgenYbbcpUjXG3O+a3/PbRJn99gKrxIiGY9T4r+KRdxBbAd
L7zvBcaEDIzWlwPlwlYbtHreMizCd2glmivDQPtAIOXblUoq3m1frpS0Gm+Tubwm
bgTalwF5Zfh9ktQxGpc/5WTxcd4wITSGkpwxHkZq0oPmgvo8/A==
=eGBZ
-----END PGP SIGNATURE-----

#1151279#34

Date:: 2026-10-21 03:49:58 UTC

From:

To:

Hi,

As for the previous uploads, I suggest to follow 1.6.x (upstream's
current LTS release) for trixie-security.  The upstream diff [0] is
targeted anyway.  Several of the issues, in particular the SSRF, XSS and
remote-content blocker bypass, have test coverage.

Tested debdiff attached.  Debusine result:
https://debusine.debian.net/debian/developers/work-request/1508582/

Cheers,

#1151279#39

Date:: 2026-10-21 03:52:57 UTC

From:

To:

Oops, now with the right recipient and the attachment.

#1151279#44

Date:: 2026-10-21 05:59:06 UTC

From:

To:

assigned.

Will post them here as soon as I have them.

Kind regards,

     Edmund

#1151279#49

Date:: 2026-10-21 05:59:06 UTC

From:

To:

assigned.

Will post them here as soon as I have them.

Kind regards,

     Edmund

#1151279#54

Date:: 2026-10-21 06:06:49 UTC

From:

To:

Thank you, much appreciated!  I'll retroactively update d/changelog
after that.  One CVE ID was assigned meanwhile (CVE-2026-113386), I
guess it was requested by the reporter in parallel.

#1151279#59

Date:: 2026-10-21 08:21:37 UTC

From:

To:

Actually, I filed only one first, to make sure I got it right and accepted; and then I filed the rest :-)

#1151279#64

Date:: 2026-10-22 06:53:24 UTC

From:

To:

Here we go:

   * Fix IMAP command injection via CRLF in _uid parameter of
mail/headers and mail/viewsource
     action

https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
     CVE-2026-113386
https://www.cve.org/CVERecord?id=CVE-2026-113386
   * Fix bug where an alias login wasn’t qualified by IMAP host

https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
     CVE-2026-114732
https://www.cve.org/CVERecord?id=CVE-2026-114732
   * Add a size limit to the CSS proxy content processing

https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
     CVE-2026-114731
https://www.cve.org/CVERecord?id=CVE-2026-114731
   * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96

https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
     CVE-2026-114730
https://www.cve.org/CVERecord?id=CVE-2026-114730
   * Fix remote content blocking bypass via SVG SMIL by attribute

https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
     CVE-2026-114729
https://www.cve.org/CVERecord?id=CVE-2026-114729
   * Fix remote content blocking bypass via CSS escapes in FuncIRI
attributes (again)

https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
     CVE-2026-114728
https://www.cve.org/CVERecord?id=CVE-2026-114728
   * Fix passing potentally unsafe attachment content into ImageMagick
on image resize

https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
     CVE-2026-114727
https://www.cve.org/CVERecord?id=CVE-2026-114727
   * Fix mail header injection via the From display-name in the Bounce
(resend) action

https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
     CVE-2026-114726
https://www.cve.org/CVERecord?id=CVE-2026-114726
   * Fix mail header injection via
References/In-Reply-To/Message-ID/From parameters

https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
     CVE-2026-114725
https://www.cve.org/CVERecord?id=CVE-2026-114725
   * Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
     keys

https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
     CVE-2026-114724
https://www.cve.org/CVERecord?id=CVE-2026-114724

https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
     CVE-2026-114723
https://www.cve.org/CVERecord?id=CVE-2026-114723
   * Fix CSS scoping bypass in HTML messages using at-rules

https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
     CVE-2026-114722
https://www.cve.org/CVERecord?id=CVE-2026-114722
   * Fix bug where deprecated action aliases bypassed disabled_actions
setting

https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
     CVE-2026-114721
https://www.cve.org/CVERecord?id=CVE-2026-114721
   * Fix IMAP command injection via CRLF in _flag parameter of mail/mark
action

https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
     CVE-2026-114720
https://www.cve.org/CVERecord?id=CVE-2026-114720
   * Fix CSRF validation bypass in the mark-as-junk action

https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
     CVE-2026-114719
https://www.cve.org/CVERecord?id=CVE-2026-114719
   * Fix XSS issue in handling of password driver error responses

https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
     CVE-2026-114718
https://www.cve.org/CVERecord?id=CVE-2026-114718
   * Fix mail header injection via subject of a message forwarded as
attachment

https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
     CVE-2026-114717
https://www.cve.org/CVERecord?id=CVE-2026-114717
   * Fix mail header injection via media type in an inline image data URI

https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
     CVE-2026-114716
https://www.cve.org/CVERecord?id=CVE-2026-114716
   * Fix bug where Password Modoboa driver could change password for
another account

https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
     CVE-2026-114715
https://www.cve.org/CVERecord?id=CVE-2026-114715
   * Fix unsafe use of a login name in SquirrelMail import file path

https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
     CVE-2026-114714
https://www.cve.org/CVERecord?id=CVE-2026-114714

#1151279#69

Date:: 2026-10-22 06:53:24 UTC

From:

To:

Here we go:

   * Fix IMAP command injection via CRLF in _uid parameter of
mail/headers and mail/viewsource
     action

https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
     CVE-2026-113386
https://www.cve.org/CVERecord?id=CVE-2026-113386
   * Fix bug where an alias login wasn’t qualified by IMAP host

https://github.com/roundcube/roundcubemail/commit/cb235cbfef88cbf78236dc67d3b667bf3dc61ddd
     CVE-2026-114732
https://www.cve.org/CVERecord?id=CVE-2026-114732
   * Add a size limit to the CSS proxy content processing

https://github.com/roundcube/roundcubemail/commit/99a5bdd05b01f45493cc0da4c96968eac7668126
     CVE-2026-114731
https://www.cve.org/CVERecord?id=CVE-2026-114731
   * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96

https://github.com/roundcube/roundcubemail/commit/3c3a65f66b53b7aaf3d720acd06e0b102eceb090
     CVE-2026-114730
https://www.cve.org/CVERecord?id=CVE-2026-114730
   * Fix remote content blocking bypass via SVG SMIL by attribute

https://github.com/roundcube/roundcubemail/commit/2b6ff79d8b14f94b0ff04765b7f02dbfdfe98efa
     CVE-2026-114729
https://www.cve.org/CVERecord?id=CVE-2026-114729
   * Fix remote content blocking bypass via CSS escapes in FuncIRI
attributes (again)

https://github.com/roundcube/roundcubemail/commit/ff4fcfdd2952f9d09947cc9c18137f381f27caf1
     CVE-2026-114728
https://www.cve.org/CVERecord?id=CVE-2026-114728
   * Fix passing potentally unsafe attachment content into ImageMagick
on image resize

https://github.com/roundcube/roundcubemail/commit/895d88af37720d2b46e4553f524013b2e1cb7665
     CVE-2026-114727
https://www.cve.org/CVERecord?id=CVE-2026-114727
   * Fix mail header injection via the From display-name in the Bounce
(resend) action

https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
     CVE-2026-114726
https://www.cve.org/CVERecord?id=CVE-2026-114726
   * Fix mail header injection via
References/In-Reply-To/Message-ID/From parameters

https://github.com/roundcube/roundcubemail/commit/79adcfc0c48012bbbe930278471425027fd7331c
     CVE-2026-114725
https://www.cve.org/CVERecord?id=CVE-2026-114725
   * Fix object injection primitive in rcube_session::unserialize() via
“!”-prefixed session
     keys

https://github.com/roundcube/roundcubemail/commit/833770d3d3c35cfde74cc2614d368f25a75b6f99
     CVE-2026-114724
https://www.cve.org/CVERecord?id=CVE-2026-114724

https://github.com/roundcube/roundcubemail/commit/0bea81121efd96f07432a837f391dbdd0dffa33f
     CVE-2026-114723
https://www.cve.org/CVERecord?id=CVE-2026-114723
   * Fix CSS scoping bypass in HTML messages using at-rules

https://github.com/roundcube/roundcubemail/commit/ff9cf4a9bf3b7c66db9afe43fe5f1cc73b47ed35
     CVE-2026-114722
https://www.cve.org/CVERecord?id=CVE-2026-114722
   * Fix bug where deprecated action aliases bypassed disabled_actions
setting

https://github.com/roundcube/roundcubemail/commit/e7c512ae09ebd0ae5d0d2f29e00a767bf91f6bbe
     CVE-2026-114721
https://www.cve.org/CVERecord?id=CVE-2026-114721
   * Fix IMAP command injection via CRLF in _flag parameter of mail/mark
action

https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
     CVE-2026-114720
https://www.cve.org/CVERecord?id=CVE-2026-114720
   * Fix CSRF validation bypass in the mark-as-junk action

https://github.com/roundcube/roundcubemail/commit/15b0dc0d6e5712310c8f663577361bf8132a7f81
     CVE-2026-114719
https://www.cve.org/CVERecord?id=CVE-2026-114719
   * Fix XSS issue in handling of password driver error responses

https://github.com/roundcube/roundcubemail/commit/94298856ee67ff7817cc4def2adb634be91e28c7
     CVE-2026-114718
https://www.cve.org/CVERecord?id=CVE-2026-114718
   * Fix mail header injection via subject of a message forwarded as
attachment

https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0b974095dd4
     CVE-2026-114717
https://www.cve.org/CVERecord?id=CVE-2026-114717
   * Fix mail header injection via media type in an inline image data URI

https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
     CVE-2026-114716
https://www.cve.org/CVERecord?id=CVE-2026-114716
   * Fix bug where Password Modoboa driver could change password for
another account

https://github.com/roundcube/roundcubemail/commit/3d9d05bfe2da7f93b8d47e68cadab22bb67e6cc9
     CVE-2026-114715
https://www.cve.org/CVERecord?id=CVE-2026-114715
   * Fix unsafe use of a login name in SquirrelMail import file path

https://github.com/roundcube/roundcubemail/commit/15fd175d154311ca7f59cf696c6cc39471611aa6
     CVE-2026-114714
https://www.cve.org/CVERecord?id=CVE-2026-114714

#1151279#74

Date:: 2026-10-22 07:02:18 UTC

From:

To:

Thank you!  That was fast.  (I wonder how come my assignment request for
the previous batch from early September has not been addressed yet
though.)

Security Team: I already uploaded 1.6.20+dfsg-0+deb13u1 to
trixie-security yesterday but as it's not been installed to the archive
yet, let me know if you prefer to trash it and get a new upload with the
CVE numbers instead.

Cheers

#1151279#79

Date:: 2026-10-22 08:55:04 UTC

From:

To:

Hi Guilhem,

As confirmed on IRC, we can simply go ahead with what we have and just
make sure the CVEs are mentioned in the DSA.

Edmund, thanks for requesting the CVEs.

Regards,
Salvatore

#1151279#84

Date:: 2026-10-22 09:09:01 UTC

From:

To:

Pleasure, glad I could be of help!

#1151279 roundcube: Multiple security vulnerabilities #1151279

Just Reply to ...

Reply to submitter ...

Send control command (Silently)

Set Architecture Tags (Silently)