Twelve Fixes, Two Standouts

Roundcube, one of the most widely deployed open-source webmail clients, has released version 1.6.19 for its long-term-support branch and 1.7.4 for its current branch, closing twelve distinct security vulnerabilities. While the full list touches everything from contact management to HTML rendering, two flaws in particular stand out for how easily they could be exploited against unsuspecting users.

A Stored XSS That Needs No Clicks

The most serious issue is a stored cross-site scripting vulnerability triggered through TNEF MIME tag injection into attachment URLs. TNEF is a Microsoft-specific attachment format often seen in emails sent from Outlook, and Roundcube’s handling of these tags allowed an attacker to smuggle in script content tied to how attachment links get generated. Because the malicious script fires as soon as the victim simply views the crafted message — no clicking, no downloading required — this qualifies as a zero-click flaw, the kind of bug that can compromise a webmail session purely through the act of reading an inbox.

A second, related XSS affects the HTML editor’s handling of text/enriched email content, giving attackers another route to inject scripts through specially formatted messages.

Sneaking Requests Past the SSRF Filter

The second headline fix addresses a server-side request forgery bypass in Roundcube’s CSS proxy, the component responsible for fetching remote stylesheets referenced in HTML email. Roundcube validates URLs through an is_local_url() check meant to block requests aimed at internal network addresses. Researchers found they could sidestep that check using hexadecimal-formatted IPv6-mapped IPv4 addresses — an address format the validation logic didn’t anticipate — potentially letting an attacker coerce the mail server into making requests against internal infrastructure it should never be able to reach. A related bypass involved fully qualified domain names with a trailing dot, another quirk of URL parsing that slipped past the original filter.

The Rest of the Dozen

The remaining fixes cover a broad swath of Roundcube’s attack surface:

• Multiple email header injection issues affecting subject lines, recipient display names, and organization fields
• A SQL-related address book flaw that let one user modify another user’s contact group associations
• CSS declaration smuggling and HTML body background injection techniques
• CSS-escape bypasses affecting FuncIRI attribute handling
• Abuse of SVG SMIL animation elements as a vector for remote content loading

Individually, several of these might look minor. Together, they show how many small parsing decisions — how a mail client interprets a header, a stylesheet, an SVG tag, or an attachment reference — can compound into serious exposure for a piece of software that, by design, renders untrusted, attacker-controlled content every time a user opens their inbox.

Why Webmail Bugs Deserve Extra Urgency

Webmail clients occupy an unusual position in the security landscape: they are expected to render HTML email from arbitrary senders, which means every rendering shortcut or validation gap is a potential foothold for an attacker. A zero-click stored XSS in a widely self-hosted platform like Roundcube is especially concerning because it requires no social engineering at all — an attacker only needs the target’s email address and a way to get a message into their inbox, something that spam filters don’t always catch in time.

Roundcube powers webmail for a large number of hosting providers, universities, and small-to-midsize organizations that run it on their own infrastructure, often with less dedicated security monitoring than large enterprise mail platforms. That makes prompt patching especially important here, since there’s no cloud provider quietly rolling out a fix on users’ behalf.

What Administrators Should Do

• Upgrade to Roundcube 1.6.19 (LTS) or 1.7.4 as soon as possible — these are cumulative security releases, not optional feature updates.
• Review server logs for unusual attachment-handling errors or unexpected outbound requests from the CSS proxy component, which could indicate attempted exploitation.
• Restrict outbound network access from mail server components where feasible, limiting the blast radius of any future SSRF-style bypass.
• Remind users that opening an email is not a risk-free action on unpatched webmail software, particularly for zero-click vulnerability classes like this one.