Fedora 43 Roundcube Webmail Important XSS SQL Issues 2026-07ee097ffe

RoundCube Webmail is a browser-based multilingual IMAP client

with an application-like user interface. It provides full

functionality you expect from an e-mail client, including MIME

support, address book, folder manipulation, message searching

and spell checking. RoundCube Webmail is written in PHP and

requires a database: MySQL, PostgreSQL and SQLite are known to

work. The user interface is fully skinnable using XHTML and

CSS 2.

Release 1.6.16 Fix potential too long value in IMAP ID command (#10136) Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog Security: Fix CSS injection bypass in HTML sanitizer via SVG Security: Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass Security: Fix SSRF bypass via specific local address URLs Security: Fix bypass of remote image blocking via CSS var() Security: Fix local/private URL fetch bypass when remote resources were not allowed Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass Security: Fix code injection vulnerability - remove support for code evaluation in LDAP autovalues option