Critical Security Advisory: Patching Multiple High-Severity Vulnerabilities in Roundcube Webmail

Administrators managing Roundcube Webmail deployments are facing an urgent mandate to update their software environments.

A recent security disclosure has revealed a series of significant vulnerabilities, headlined by a critical pre-authentication SQL injection flaw. This specific weakness is particularly alarming because it permits an unauthenticated attacker to execute arbitrary database queries, bypassing the entire login mechanism.

To remediate these risks, the Roundcube development team has released essential security patches in versions 1.6.16 and 1.7.1, officially published on May 24, 2026. These updates cover both long-term support (LTS) and current release branches.

Technical Deep Dive: The Vulnerability Landscape

The most severe threat identified is a pre-auth SQL injection residing within the virtuser_query plugin. At a technical level, the vulnerability stems from improper input sanitization—specifically, a failure to account for a preg_replace backslash escape bypass. This flaw allows a malicious actor to manipulate input strings to break out of intended query structures, effectively injecting unauthorized SQL commands into the database engine before the system even asks for a username or password.

Beyond the database layer, the update also mitigates a dangerous code injection vulnerability found in the LDAP autovalues option. Previously, the system allowed unsafe code evaluation, which could be leveraged by an attacker to achieve Remote Code Execution (RCE). The developers have since completely removed this unsafe evaluation logic to harden the application against such exploits.

The release also addresses a complex “attack chain” potential, where multiple smaller vulnerabilities—such as CSS injection and SSRF bypasses—could be orchestrated to escalate a minor breach into a full system compromise.

Summary of Fixed Security Flaws

• Pre-auth SQL Injection: Exploitation of the virtuser_query plugin via preg_replace escape bypass.
• Code Injection: Removal of unsafe code evaluation within the LDAP autovalues configuration.
• Pre-auth Arbitrary File Deletion: Mitigation of session poisoning attacks targeting Redis and Memcache backends.
• Stored XSS: Patching of the draft restore dialog subject field to prevent HTML/CSS injection.
• CSS Injection Bypass: Hardening the HTML sanitizer against SVG animate attribute manipulation.
• SSRF & Resource Bypasses: Resolving bypasses related to local address URLs, remote resource fetching, and CSS var() manipulation for remote image loading.

Remediation and Best Practices

The vulnerabilities were identified through coordinated efforts by several security entities, including the Orange Cyberdefense Vulnerability Disclosure Team and various independent researchers. This collaborative discovery underscores the sophisticated nature of the threats currently facing webmail infrastructure.

Immediate Action Required:

Any installation running Roundcube versions 1.6.x or 1.7.x is considered vulnerable. System administrators must prioritize upgrading to version 1.6.16 or 1.7.1 immediately.

Post-Patching Security Hardening:

• Audit Logs: Conduct a thorough review of system and database logs for any signs of anomalous query patterns or unauthorized access attempts.
• Minimize Attack Surface: If the virtuser_query plugin is not strictly necessary for your environment, disable it to eliminate the primary SQL injection vector.
• Session Management: Ensure that Redis or Memcache configurations are properly secured to prevent the session poisoning that leads to arbitrary file deletion.
• Access Control: Implement strict network-level access controls to limit exposure of the webmail interface to known, trusted IP ranges where possible.

Given the critical nature of these flaws, especially for internet-facing mail servers, patching should be treated as a high-priority operational task to prevent data exfiltration and unauthorized system control.