MGASA-2026-0358
Updated roundcubemail packages fix security vulnerabilities
No scoreFix available
- Add basic validation for content proxied by the css proxy
- Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
- Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
- Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe
- Fix LDAP filter injection via unescaped %u/%fu/%d substitution into
the
search_filter, reported by Milan Hoppe - Fix arbitrary Sieve script injection via a filter rule name
bypassing
managesieve_disabled_actions, reported by Milan Hoppe - Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
- Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai
- Fix password’s modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun
- Fix stored XSS in “Add to address book” action, reported by Paulos Yibelo from pwn.ai
- Fix HTML/CSS sanitization bypass via SVG animate
byattribute, reported by vectrain
What each source reports
OSV No score
Updated roundcubemail packages fix security vulnerabilities
- Add basic validation for content proxied by the css proxy
- Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, reported by Dmytro Ivanenko
- Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check, reported by Milan Hoppe
- Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute, reported by Milan Hoppe
- Fix LDAP filter injection via unescaped %u/%fu/%d substitution into
the
search_filter, reported by Milan Hoppe - Fix arbitrary Sieve script injection via a filter rule name
bypassing
managesieve_disabled_actions, reported by Milan Hoppe - Fix RCE via cmd_learn driver of markasjunk plugin, reported by nept1337
- Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization, reported by Zach Hanley of Horizon3.ai
- Fix password’s modoboa driver leak of an authentication token to a user-controlled host, reported by meifukun
- Fix stored XSS in “Add to address book” action, reported by Paulos Yibelo from pwn.ai
- Fix HTML/CSS sanitization bypass via SVG animate
byattribute, reported by vectrain
- Record
MGASA-2026-0358- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
roundcubemailMageia:9 |
before 1.6.18-1.mga9 | 1.6.18-1.mga9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2026-0358 is a vulnerability with no CVSS score yet in roundcubemail, published September 1, 2026. No source lists public exploit code. Fixed in roundcubemail 1.6.18-1.mga9.