# FEDORA-2026-DB7E033531: roundcubemail security update FEDORA-2026-DB7E033531, released November 7, 2026, fixes 20 CVEs in roundcubemail (version 1.6.20-1.fc43). None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/fedora-2026-db7e033531 - Platform: Linux - Released: Nov 7, 2026 - Priority: High (Closes CVE-2026-114720, high severity) - CVEs: 20, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://bodhi.fedoraproject.org/updates/FEDORA-2026-db7e033531 ## Applies to | Product | Release | Fixed in | |---|---|---| | [roundcubemail](https://patchblox.com/security/data/product/linux/roundcubemail.md) | Fedora 43 | 1.6.20-1.fc43 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2026-114720](https://patchblox.com/security/data/cve/CVE-2026-114720.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability | 7.1 | 0.0079 | | | [CVE-2026-114724](https://patchblox.com/security/data/cve/CVE-2026-114724.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unser... | 8.1 | 0.0041 | | | [CVE-2026-114716](https://patchblox.com/security/data/cve/CVE-2026-114716.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability | 8.5 | 0.0039 | | | [CVE-2026-114732](https://patchblox.com/security/data/cve/CVE-2026-114732.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in mul... | 8.1 | 0.0038 | | | [CVE-2026-114730](https://patchblox.com/security/data/cve/CVE-2026-114730.md) | High | roundcube: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass | 7.2 | 0.0037 | | | [CVE-2026-114727](https://patchblox.com/security/data/cve/CVE-2026-114727.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizi... | 8.3 | 0.0033 | | | [CVE-2026-114723](https://patchblox.com/security/data/cve/CVE-2026-114723.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during t... | 5.3 | 0.0046 | | | [CVE-2026-114729](https://patchblox.com/security/data/cve/CVE-2026-114729.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass | 5.3 | 0.0038 | | | [CVE-2026-114728](https://patchblox.com/security/data/cve/CVE-2026-114728.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handlin... | 5.3 | 0.0037 | | | [CVE-2026-114714](https://patchblox.com/security/data/cve/CVE-2026-114714.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelm... | 5.3 | 0.0037 | | | [CVE-2026-114717](https://patchblox.com/security/data/cve/CVE-2026-114717.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a me... | 5.8 | 0.0037 | | | [CVE-2026-114726](https://patchblox.com/security/data/cve/CVE-2026-114726.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bo... | 5.8 | 0.0033 | | | [CVE-2026-114721](https://patchblox.com/security/data/cve/CVE-2026-114721.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed | 3.1 | 0.0030 | | | [CVE-2026-114718](https://patchblox.com/security/data/cve/CVE-2026-114718.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the pas... | 6.1 | 0.0029 | | | [CVE-2026-114725](https://patchblox.com/security/data/cve/CVE-2026-114725.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability | 5.0 | 0.0028 | | | [CVE-2026-47759](https://patchblox.com/security/data/cve/CVE-2026-47759.md) | Routine | roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views... | n/a | 0.0028 | | | [CVE-2026-47762](https://patchblox.com/security/data/cve/CVE-2026-47762.md) | Routine | roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views... | n/a | 0.0028 | | | [CVE-2026-47761](https://patchblox.com/security/data/cve/CVE-2026-47761.md) | Routine | roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views... | n/a | 0.0026 | | | [CVE-2026-114722](https://patchblox.com/security/data/cve/CVE-2026-114722.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages | 6.5 | 0.0025 | | | [CVE-2026-114719](https://patchblox.com/security/data/cve/CVE-2026-114719.md) | Routine | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk ac... | 4.3 | 0.0022 | | --- Data as of 2026-11-09T19:38:12Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.