# OPENSUSE-SU-2026:22195-1: roundcubemail security update

OPENSUSE-SU-2026:22195-1, released November 7, 2026, fixes 18 CVEs in roundcubemail (version 1.6.20-bp160.1.1). One of them is being exploited (CVE-2025-49113); 1 on CISA KEV. Patch Radar priority: Patch now.

- Web page: https://patchblox.com/security/fix/linux/opensuse-su-2026-22195-1
- Platform: Linux
- Released: Nov 7, 2026
- Priority: Patch now (Closes CVE-2025-49113, exploited (CISA KEV))
- CVEs: 18, exploited: 1, on CISA KEV: 1
- Vendor advisory: https://osv.dev/vulnerability/openSUSE-SU-2026:22195-1

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [roundcubemail](https://patchblox.com/security/data/product/linux/roundcubemail.md) | opensuse-leap 16.0 | 1.6.20-bp160.1.1 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2025-49113](https://patchblox.com/security/data/cve/CVE-2025-49113.md) | Patch now | roundcube: Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote codeexecution by authenticated users because th... | 8.8 | 0.9960 | CISA KEV |
| [CVE-2026-75003](https://patchblox.com/security/data/cve/CVE-2026-75003.md) | Urgent | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, an unclosed url() in a FuncIRI attribute of an SVG image c... | 9.8 | 0.0048 |  |
| [CVE-2026-54433](https://patchblox.com/security/data/cve/CVE-2026-54433.md) | Urgent | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted p... | 10.0 | 0.0037 |  |
| [CVE-2026-62643](https://patchblox.com/security/data/cve/CVE-2026-62643.md) | Urgent | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, insufficient Cascading Style Sheets (CSS) sanitization in... | 10.0 | 0.0030 |  |
| [CVE-2026-62644](https://patchblox.com/security/data/cve/CVE-2026-62644.md) | Urgent | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the password plugin of the Roundcube Webmail was subject t... | 9.8 | 0.0026 |  |
| [CVE-2026-75002](https://patchblox.com/security/data/cve/CVE-2026-75002.md) | High | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization coul... | 7.1 | 0.0136 |  |
| [CVE-2026-113386](https://patchblox.com/security/data/cve/CVE-2026-113386.md) | High | roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection | 7.1 | 0.0100 |  |
| [CVE-2026-74997](https://patchblox.com/security/data/cve/CVE-2026-74997.md) | High | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the cmd_learn driver of the markasjunk plugin is subject t... | 8.8 | 0.0078 |  |
| [CVE-2026-75007](https://patchblox.com/security/data/cve/CVE-2026-75007.md) | High | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the LDAP search filter was subject to injection via unesca... | 8.8 | 0.0035 |  |
| [CVE-2026-74998](https://patchblox.com/security/data/cve/CVE-2026-74998.md) | High | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, responses from the CSS (Cascading Style Sheets) proxy were... | 7.2 | 0.0032 |  |
| [CVE-2026-75006](https://patchblox.com/security/data/cve/CVE-2026-75006.md) | Routine | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, insufficient Cascading Style Sheets (CSS) sanitization in... | 5.8 | 0.0042 |  |
| [CVE-2026-75000](https://patchblox.com/security/data/cve/CVE-2026-75000.md) | Routine | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper HTML/CSS sanitization of the SVG animate "by" att... | 5.8 | 0.0035 |  |
| [CVE-2026-75010](https://patchblox.com/security/data/cve/CVE-2026-75010.md) | Routine | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the modoboa driver of the password plugin could leak a Mod... | 4.3 | 0.0029 |  |
| [CVE-2026-62642](https://patchblox.com/security/data/cve/CVE-2026-62642.md) | Routine | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, an infinite loop was discovered in the TNEF decoder, which... | 6.5 | 0.0028 |  |
| [CVE-2026-75004](https://patchblox.com/security/data/cve/CVE-2026-75004.md) | Routine | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, improper rule name quoting could lead to managesieve_disab... | 4.3 | 0.0027 |  |
| [CVE-2026-74999](https://patchblox.com/security/data/cve/CVE-2026-74999.md) | Routine | roundcube: In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, the "Add to address book" action was subject to stored XSS. | 5.4 | 0.0026 |  |
| [CVE-2026-62641](https://patchblox.com/security/data/cve/CVE-2026-62641.md) | Routine | roundcube: In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, the TNEF decoder was subject to denial of service via a cr... | 6.5 | 0.0025 |  |
| [CVE-2026-54432](https://patchblox.com/security/data/cve/CVE-2026-54432.md) | Routine | roundcube: Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2 allows Stored Cross-Site Scripting (XSS) | 4.7 | 0.0022 |  |

---

Data as of 2026-11-10T20:03:11Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.