Home / mailings [SECURITY] [DSA 6579-1] roundcube security update
Posted on 23 October 2026
Debian Security Advisory- -------------------------------------------------------------------------
Debian Security Advisory DSA-6579-1 security@debian.org
https://www.debian.org/security/ Salvatore Bonaccorso
October 23, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : roundcube
CVE ID : CVE-2026-113386 CVE-2026-114714 CVE-2026-114715 CVE-2026-114716
CVE-2026-114717 CVE-2026-114718 CVE-2026-114719 CVE-2026-114720
CVE-2026-114721 CVE-2026-114722 CVE-2026-114723 CVE-2026-114724
CVE-2026-114725 CVE-2026-114726 CVE-2026-114727 CVE-2026-114728
CVE-2026-114729 CVE-2026-114730 CVE-2026-114731 CVE-2026-114732
Debian Bug : 1151279
Multiple vulnerabilities were discovered in roundcube, a skinnable AJAX
based webmail solution for IMAP servers, which could result in IMAP
command injection, cross-site scripting, SSRF bypass, email header
injection, css property injection, remote content blocking bypass,
information disclosure or privilege escalation.
For the stable distribution (trixie), these problems have been fixed in
version 1.6.20+dfsg-0+deb13u1.
We recommend that you upgrade your roundcube packages.
For the detailed security status of roundcube please refer to its
security tracker page at:
https://security-tracker.debian.org/tracker/roundcube
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
