Roundcube 1.6.20 and 1.7.5 fix 20 flaws as older SQL injection sees active exploitation

Two problems, two timelines

On 19 October 2026 the Roundcube webmail project shipped versions 1.6.20 and 1.7.5, which together close 20 reported vulnerabilities, and urged administrators to bring every live 1.6.x and 1.7.x installation up to date. Two weeks earlier, on 3 October, Singapore's Cyber Security Agency (CSA) issued an alert about a different, older Roundcube flaw: a SQL injection reachable without logging in, which attackers are reportedly already exploiting.

As a write-up on dev.to (originally published on fanpino.com) explains, these are two separate problems with different fixed versions, so administrators need to check each one.

The flaw under active attack

CVE-2026-48842, according to its NVD entry, affects Roundcube 1.6.x before 1.6.16 and 1.7.x before 1.7.1. It is a pre-authentication SQL injection in the virtuser_query plugin, which resolves login names to mailbox users by querying a database. The root cause is a backslash escape that the plugin's preg_replace() call fails to strip. CSA scores the issue at 8.1 under CVSS v3.1 and notes that it lets an attacker reach the underlying database without valid credentials.

Two factors decide exposure. The bug lives in a plugin, and Roundcube plugins only load when listed in the configuration, so a server without virtuser_query enabled is not directly exposed. And because the fix landed on 24 May 2026, any server that has taken an update since late May is already past it — the exposed population is installations untouched since spring, precisely the unattended systems attackers scan for.

What the October releases fix

The 20 issues closed in 1.6.20 and 1.7.5 are a separate matter, and the project has not reported active exploitation of any of them. NVD began publishing records on 22 October, three of which stand out:

• CVE-2026-114727, scored 8.3: attachment content that may be unsafe is handed to ImageMagick when images are resized.
• CVE-2026-114730, scored 7.2: the server-side request forgery filter can be bypassed through the NAT64 range 64:ff9b::/96.
• CVE-2026-114732, scored 6.8: on multi-host installations, an alias login was not bound to the IMAP host it belonged to.

The dev.to write-up lists the rest: IMAP command injection via CRLF characters in the _uid and _flag parameters, several header injection paths, a CSRF bypass in the mark-as-junk action, an XSS in password driver error handling, and a Modoboa password driver bug that let one account's password be changed from another. Several of these require an authenticated session, so the practical risk scales with how many accounts can sign in.

Checking your installation

The version string sits in program/include/iniset.php as RCMAIL_VERSION, and also appears under About in the settings menu unless it has been hidden. On the 1.6 branch the target is 1.6.20, and anything from 1.6.0 through 1.6.15 is also open to the exploited CVE. On the 1.7 branch the target is 1.7.5, with 1.7.0 also exposed to it. Releases 1.5 and older are not covered by these updates and need a move to 1.6 LTS.

Installs bundled inside a control panel, mail suite or container image deserve extra care, since the bundle's own version number says nothing about the embedded Roundcube; the dev.to article advises checking the version inside the bundle and whether the vendor has shipped the patched releases.

Before updating, back up the database and the config/ directory. Install 1.6.20 or 1.7.5 from the official GitHub releases or a distribution package, run the update script so the schema matches, then prune the plugins array of anything unused. If virtuser_query was enabled on a version older than 1.6.16 or 1.7.1, the server should be treated as possibly compromised. PHP itself must also be current: the PHP2Shell flaws disclosed on 21 October apply to Roundcube's runtime, and updating Roundcube does not update PHP.

If the exposed combination was running

A SQL injection into the Roundcube database can reach whatever that database holds: user preferences, address books, identities and, depending on configuration, the session table. The write-up suggests searching web server logs for backslashes and SQL keywords in pre-patch login requests; checking what else the Roundcube database user can touch and narrowing it to the Roundcube database only; clearing the session table and rotating the des_key after the update; and rotating mail-server credentials if the same database server stores them.

Why it matters

Webmail is internet-facing by design and touches IMAP, SMTP, a database, an image library and the PHP runtime, so a weakness in any one layer becomes a weakness of the whole mail service. The actively exploited flaw here is instructive: it sits in an optional plugin, on servers untouched since spring. Alongside the recent Zimbra SNMP command injection and the PHP2Shell disclosures, it is another reminder that enabled add-ons and the runtime underneath matter as much as the mail application itself.