Roundcube, a webmail frontend, released versions 1.5.14 and 1.6.14 on March 18 with fixes to a multitude of vulnerabilities. The 1.7 pre-releases are also affected.
>From the release announcement ><https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14>: * Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. * Fix bug where a password could get changed without providing the old password, reported by flydragon777. * Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. * Fix remote image blocking bypass via various SVG animate attributes, reported by nullcathedral. * Fix remote image blocking bypass via a crafted body background attribute, reported by nullcathedral. * Fix fixed position mitigation bypass via use of !important, reported by nullcathedral. * Fix XSS issue in a HTML attachment preview, reported by aikido_security. * Fix SSRF + Information Disclosure via stylesheet links to a local network hosts, reported by Georgios Tsimpidas (aka Frey), Security Researcher at https://i0.rs/. The file write is apparently CVE-2026-35537. Roundcube still does not provide CVE numbers in their official announcements, interested parties can look them up for the rest for example at the Debian security tracker <https://security-tracker.debian.org/tracker/source-package/roundcube>. -Valtteri
