Roundcube 1.6.20 and 1.7.5: 20 Fixes, and an Older SQL Injection Now Being Exploited

On 19 October 2026 the Roundcube project released versions 1.6.20 and 1.7.5, with fixes for 20 reported vulnerabilities, and wrote: "We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x". Two weeks earlier, on 3 October, Singapore's Cyber Security Agency warned that an older Roundcube flaw, a SQL injection that works before login, "is reportedly being actively exploited".

Those are two separate problems with different fixed versions. If your webmail runs Roundcube, here is how to tell which one applies to you and what to do this week.

The exploited one: CVE-2026-48842

According to the NVD entry, Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1 has a pre-authentication SQL injection in the virtuser_query plugin, caused by a backslash escape that slips past preg_replace(). The fix shipped in May, in the 1.6.16 and 1.7.1 releases of 24 May 2026. CSA rates it 8.1 under CVSS v3.1 and says it lets "an unauthenticated attacker" inject SQL into the underlying database.

Two details decide whether you are exposed. First, the bug is in a plugin. virtuser_query maps logins to mailbox users through a database query, and like every Roundcube plugin it only runs if it is listed in your configuration. Second, the fix is five months old, so a server that has taken any Roundcube update since late May is already past it. The servers at risk are the ones nobody has touched since spring, which is exactly the kind of box attackers scan for.

The new batch: 1.6.20 and 1.7.5

The October release fixes 20 issues. The project does not say any of them are being exploited. The NVD published several CVE records for them on 22 October, including:

• CVE-2026-114727, scored 8.3: potentially unsafe attachment content is passed to ImageMagick when images are resized.
• CVE-2026-114730, scored 7.2: a bypass of the server-side request forgery filter through the NAT64 range 64:ff9b::/96.
• CVE-2026-114732, scored 6.8: on multi-host installations, an alias login was not tied to its IMAP host.

The rest of the list, from the release post, is worth reading if you run Roundcube with extra plugins or drivers: IMAP command injection through CRLF in the _uid and _flag parameters, several header injection paths, a CSRF bypass in the mark-as-junk action, an XSS in password driver error handling, and a bug that let the Modoboa password driver change another account's password. Several of these need a logged-in user, so the risk depends on how many accounts can sign in.

Step 1: find your real version

The version is in program/include/iniset.php as RCMAIL_VERSION, and also shown under About in the settings menu if you have not hidden it. Compare against these:

• 1.6 branch: you need 1.6.20. Anything from 1.6.0 to 1.6.15 is also open to the exploited CVE-2026-48842.
• 1.7 branch: you need 1.7.5. 1.7.0 is also open to CVE-2026-48842.
• 1.5 or older: these releases do not cover it. Plan a move to 1.6 LTS.

If Roundcube came bundled with something else, such as a control panel, a mail server suite or a container image, the bundle's own version number tells you nothing. Check the Roundcube version inside it, and check whether the vendor has shipped 1.6.20 or 1.7.5 yet.

Step 2: update, then check the plugin list

1. Back up the Roundcube database and the config/ directory.
2. Install 1.6.20 or 1.7.5 from the official GitHub releases or your distribution's package, and run the update script so the database schema matches.
3. Open config/config.inc.php and look at the plugins array. Remove anything you do not use. If virtuser_query is there and you were below 1.6.16 or 1.7.1, treat the server as possibly compromised and go to step 3.
4. Confirm that PHP itself is current. Roundcube is a PHP application, so the PHP2Shell flaws disclosed on 21 October apply to it too, and updating Roundcube does not update PHP.

Step 3: if you ran an exposed version with virtuser_query

A SQL injection against the Roundcube database can read what that database holds: user preferences, address books, identities and, depending on configuration, the session table. Practical checks:

• Search the web server logs for unusual characters, especially backslashes and SQL keywords, in login requests from before you patched.
• Look at the database user Roundcube connects with. If it has rights on other databases on the same server, assume those were reachable too, and reduce it to the Roundcube database only.
• Expire all sessions by clearing the session table after the update, and rotate the des_key in the config.
• If the same database server holds mail-server user tables, rotate those credentials as well.

The pattern behind both

Webmail sits on the public internet and talks to IMAP, SMTP, a database, an image library and PHP, so a flaw in any of them is a flaw in the mail service. The Roundcube fixes this month are the third reminder in a few weeks, after the Zimbra SNMP command injection and PHP2Shell, that optional add-ons and the runtime underneath matter as much as the mail server itself. Enable only the plugins you use, keep the database account narrow, and track the runtime version, not just the application's. If you are rethinking the stack, our Mailcow, Stalwart and Mailu comparison covers how each one handles webmail.

Frequently asked questions

Sources: Roundcube, 19 October 2026, Roundcube, 24 May 2026, CSA Singapore alert AL-2026-131 and the NVD entries linked above.