{"id":"MGASA-2026-0507","aliases":[],"status":"published","title":"Updated roundcubemail package fixes security vulnerabilities","description":"Fix CSS declaration smuggling via un-encoded ampersand emission,\nreported by Zach Hanley of Horizon3.ai\nFix CSS property injection via body background attribute, reported by\nzenithhostingevan\nFix email header injection via bare CR in the subject field, reported by\nCVE-Hunter-Leo\nFix email header injection via C-escape \\r in the recipient display\nname, reported by dogeshark\nFix email header injection via identity’s organization field, reported\nby dogeshark\nFix zero-click stored XSS via TNEF MIME tag injection in the attachment\nURL, reported by nakko\nFix XSS in the HTML editor using text/enriched part content, reported by\nJoshua Rogers\nFix cross-user access in contact group membership (add/remove) in the\nSQL address book, reported by Joshua Rogers\nFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL,\nreported by nept1337\nFix remote content blocking bypass via CSS escapes in FuncIRI\nattributes, reported by Wahab KHADIR\nFix remote-content blocker bypass via SVG SMIL src animation\nFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4\naddresses, reported by faceless0x7 and Harish Annavisamy","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-10-15T17:19:59Z","modified":"2026-10-15T17:23:04Z","fixes":[{"ecosystem":"Mageia:10","package":"roundcubemail","fixed_in":["1.7.4-1.mga10"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:10","package":"roundcubemail","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1.mga10"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2026-0507.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36329","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES7Y7BBV2XIZNG5DARABOUMPTB5NUSFA/","tags":["web"]},{"url":"https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2026-0507","title":"Updated roundcubemail package fixes security vulnerabilities","description":"Fix CSS declaration smuggling via un-encoded ampersand emission,\nreported by Zach Hanley of Horizon3.ai\nFix CSS property injection via body background attribute, reported by\nzenithhostingevan\nFix email header injection via bare CR in the subject field, reported by\nCVE-Hunter-Leo\nFix email header injection via C-escape \\r in the recipient display\nname, reported by dogeshark\nFix email header injection via identity’s organization field, reported\nby dogeshark\nFix zero-click stored XSS via TNEF MIME tag injection in the attachment\nURL, reported by nakko\nFix XSS in the HTML editor using text/enriched part content, reported by\nJoshua Rogers\nFix cross-user access in contact group membership (add/remove) in the\nSQL address book, reported by Joshua Rogers\nFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL,\nreported by nept1337\nFix remote content blocking bypass via CSS escapes in FuncIRI\nattributes, reported by Wahab KHADIR\nFix remote-content blocker bypass via SVG SMIL src animation\nFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4\naddresses, reported by faceless0x7 and Harish Annavisamy\n","status":"published","published":"2026-10-15T17:19:59Z","modified":"2026-10-15T17:23:04.73898083Z","updated_at":"2026-11-02T15:49:43.795591Z"}]}}