Roundcube Webmail 1.6.17 Security Update: Fixes SSRF/XSS/DoS and TNEF issues

Vulnerability Overview Roundcube Webmail 1.6.17 is a security update release that addresses multiple security vulnerabilities. Impact Scope TNEF (winmail.dat) decoder: Contains an infinite loop vulnerability. Password plugin: Contains multiple vulnerabilities, including usernames susceptible to session injection. Attachment verification warning page: Contains a stored XSS vulnerability via unescaped attachment MIME types. URL handling: Contains an SSRF bypass vulnerability via specific local address URLs. Plain text rendering: Contains a zero-click stored XSS vulnerability. TNEF (winmail.dat) files: Contains a DoS vulnerability via maliciously crafted compressed RTF size. Remediation TNEF (winmail.dat) decoder: Fixed infinite loop vulnerability (#10193). Password plugin: Fixed multiple vulnerabilities, including usernames susceptible to session injection. Attachment verification warning page: Fixed stored XSS vulnerability (CVE-2026-54432). URL handling: Fixed SSRF bypass vulnerability. Plain text rendering: Fixed zero-click stored XSS vulnerability (CVE-2026-54433). TNEF (winmail.dat) files: Fixed DoS vulnerability. Additional Information Enigma support: Added support for automatic public key lookup (import) using the HKP v1 protocol (#5314). Enigma support: Added support for Kolab WOAT (#8626). Version Information Version: 1.6.17 Release Date: Last week Commit Hash: 5cd6da4 Assets roundcube-framework-1.6.17.tar.gz roundcube-framework-1.6.17.tar.gz.asc roundcubemail-1.6.17-complete.tar.gz roundcubemail-1.6.17-complete.tar.gz.asc roundcubemail-1.6.17.tar.gz roundcubemail-1.6.17.tar.gz.asc Source code (zip) Source code (tar.gz) Reactions All reactions: 4 reactions Copyright Information © 2026 GitHub, Inc. Terms Privacy Security Status Community Docs Contact Manage cookies Do not share my personal information

Goal Reached Thanks to every supporter — we hit 100%!

Roundcube Webmail 1.6.17 Security Update: Fixes SSRF/XSS/DoS and TNEF issues

More from this source