Roundcube Issues 12 Patches to Seal Zero‑Click XSS and SSRF Gaps

Open‑source webmail platform Roundcube has rolled out two security patches, versions 1.6.19 and 1.7.4, that remediate a dozen vulnerabilities discovered in its long‑term support (LTS) and current release branches. The update bundle addresses a zero‑click stored cross‑site scripting flaw, multiple bypasses of remote content filtering, and a server‑side request forgery (SSRF) bypass, among other issues.

The zero‑click XSS vulnerability, classified as “stored,” could allow an attacker to inject malicious script into a victim’s mailbox without any interaction beyond the normal receipt of an email. Once triggered, the script runs in the context of the user’s browser, potentially exposing session cookies, contacts, and other sensitive data. The SSRF bypass, meanwhile, could enable a malicious actor to force the Roundcube server to make arbitrary HTTP requests, opening a path to internal network reconnaissance or data exfiltration.

Roundcube, which powers the webmail interfaces of countless small businesses, educational institutions, and personal domains, is widely praised for its extensibility and adherence to open standards. Its popularity makes any security flaw especially concerning, as compromised installations can serve as a foothold for broader attacks on organizational email infrastructure. The vulnerabilities were originally reported by the security research collective GBHackers, prompting a rapid response from the Roundcube development team.

Beyond the headline‑making XSS and SSRF bugs, the patches also seal several lesser‑known weaknesses that could be leveraged to evade remote content filtering mechanisms. By circumventing these filters, attackers could deliver malicious payloads that would otherwise be blocked, increasing the risk of phishing or malware distribution via seemingly benign messages. The comprehensive nature of the twelve fixes reflects a concerted effort to harden both the LTS 1.6 line, which receives extended maintenance, and the newer 1.7 branch.

System administrators are urged to apply the updates immediately. The patches are available through the official Roundcube download channels and can be installed via standard package managers or by replacing the affected files manually. Given the zero‑click nature of at least one flaw, delaying remediation could expose users to exploitation without any warning signs.

Looking ahead, the Roundcube project has pledged to strengthen its security review process and to provide more frequent advisory notices. As web‑based email continues to be a critical communication vector, the episode underscores the importance of timely patch management and the role of independent security researchers in uncovering hidden risks.