Reported by 2 outlets
Roundcube Fixes 12 Security Flaws Including Zero-Click XSS and SSRF Bypass
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.59 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Roundcube Fixes 12 Security Flaws Including Zero-Click XSS and SSRF Bypass
gbhackers.com · 36d ago · September 7th, 2026
Roundcube has released security updates 1.6.19 and 1.7.4, which address 12 vulnerabilities affecting its 1.6 LTS and 1.7 Webmail branches. The flaws include a zero-click stored cross-site scripting (XSS) vulnerability, several bypasses of remote content filtering, email header injection bugs, cross-user contact access issues, and a server-side request forgery (SSRF) bypass. Published on September 6, […] The post Roundcube Fixes 12 Security Flaws Including Zero-Click XSS and SSRF Bypass appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from cyberpress.org
Roundcube Patches 12 Webmail Flaws Including Zero-Click Stored XSS and SSRF Bypass
cyberpress.org · 36d ago · September 7th, 2026
The updates, published on September 6, 2026, affect supported Roundcube 1.6.x long-term support deployments and 1.7.x installations. The project urged administrators to update production systems promptly, as several fixes address weaknesses that could let attackers bypass content restrictions, inject malicious HTML or CSS, manipulate mail headers, or access unintended internal resources. Roundcube Patches 12 Webmail Flaws The most significant issue is a zero-click stored XSS vulnerability involving the injection of TNEF MIME tags into attachment URLs. TNEF, or Transport Neutral Encapsulation Format, is a Microsoft email attachment format commonly associated with “winmail.dat” files. A malicious email could potentially embed crafted MIME metadata that causes attacker-controlled script content to be stored and executed when a recipient accesses the affected message or attachment interface. Because exploitation may not require a victim to click a malicious link, the flaw increases the risk of account compromise, session theft, or unauthorized actions in webmail. Roundcube also fixed an SSRF bypass in its CSS proxy, which is designed to retrieve and sanitize remote stylesheet resources. The bypass involved hexadecimal IPv6-mapped IPv4 address rep