The team behind Roundcube, one of the most widely deployed open-source webmail platforms, has shipped versions 1.6.18 and 1.7.3 to close eleven security vulnerabilities, the most serious of which is a remote code execution flaw reachable through the software’s built-in spam-reporting plugin. While Roundcube’s advisory notes no confirmed exploitation in the wild so far, the breadth and severity of the fixes make this an update administrators should not defer.

Remote Code Execution via the Spam-Learning Plugin

The headline issue lives in markasjunk, a bundled plugin that lets users flag messages as spam or ham to train a backend spam filter. Researcher nept1337 found that the plugin’s cmd_learn driver — the component responsible for forwarding flagged messages to the spam-learning backend — can be manipulated to execute commands within the Roundcube environment itself. Because webmail platforms like Roundcube typically sit at the center of an organization’s messaging infrastructure, a successful compromise here isn’t just a nuisance: it can give an attacker a foothold to read mail, harvest credentials, establish persistence, or pivot toward other internal systems reachable from the mail server.

Two Distinct Ways to Bypass SSRF Protections

Roundcube includes a built-in check, is_local_url(), meant to stop the application from being tricked into making requests to internal or otherwise restricted network destinations — a defense against server-side request forgery (SSRF). Researchers Dmytro Ivanenko and Milan Hoppe independently identified two separate ways around it:

• Requests directed at the carrier-grade NAT range (100.64.0.0/10) and the link-local IPv6 range (fe80::/10), address spaces the existing filter did not account for as “local”
• Specially crafted hostnames using nip.io and sslip.io — services that resolve arbitrary subdomains to attacker-chosen IP addresses — which could slip past the same-origin-style check entirely

In practice, either bypass could let an attacker coax the Roundcube server into issuing requests on their behalf to internal administrative panels, cloud provider metadata endpoints (a common path to stealing cloud credentials), or services that are only supposed to be reachable from inside the private network.

A Broader Cleanup: Nine More Issues Patched

Beyond the headline RCE and SSRF bypasses, the two releases also close a wider set of lower-profile but still meaningful bugs, including:

• LDAP filter injection
• Arbitrary Sieve mail-filtering script injection
• IMAP command injection
• A stored cross-site scripting (XSS) flaw in the “Add to address book” action
• Bypasses in Roundcube’s HTML and CSS sanitization used when rendering incoming messages
• A flaw in the password-change driver that could expose authentication tokens

Additional credit for this round of fixes goes to Zach Hanley of Horizon3.ai, Paulos Yibelo of pwn.ai, and researchers known as vectrain and meifukun — reflecting a fairly broad, multi-researcher effort behind this release.

What Administrators Should Do

Roundcube’s advisory states that it has not received reports of these flaws being exploited in the wild, which gives defenders a window to act before that changes — a window that tends to close quickly once patch details and proof-of-concept code start circulating publicly. Recommended steps include:

• Upgrading to 1.6.18 (for the 1.6.x branch) or 1.7.3 (for the 1.7.x branch) as soon as possible
• Reviewing whether the markasjunk plugin is actually needed in your deployment, and disabling it if it isn’t, as an additional layer of protection against the RCE path
• Restricting outbound network connections from the host running Roundcube, limiting what an SSRF bypass could actually reach even if one is exploited
• Auditing access to sensitive internal services and metadata endpoints from the mail server’s network segment

Given how central webmail access is to everyday business operations — and how attractive a mail server is as a pivot point for further compromise — organizations running self-hosted Roundcube instances should prioritize this update alongside their regular patch cycle rather than waiting for the next scheduled maintenance window.