Security Updates 1.6.16 And 1.7.1

roundcube.net • May 27, 2026

We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail. They both contain fixes for recently reported security vulnerabilities.

See the full changelogs in the release notes on the Github download pages for the updated versions 1.6.16 and 1.7.1 .

We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Roundcube Webmail Vulnerabilities Expose Systems to Malware Attacks Roundcube Webmail has been found vulnerable due to eight security flaws, four of which are rated high severity (CVE-2026-48842, CVE-2026-48843, CVE-2026-48844, CVE-2026-48848). Attackers can exploit these vulnerabilities through SQL injection and Stored XSS attacks, potentially allowing them to execute malicious code on affected systems. Security updates for versions 1.6.16 and 1.7.1 have been released to address these issues. Administrators are urged to apply these patches immediately to mitigate risks. As of now, there are no reports of active exploitation of these vulnerabilities. The last security update was issued in March 2026, indicating a proactive approach to security by the developers. 4 sources 71

Extracted Entities

Platforms (1)

Roundcube Webmail