FEDORA-2026-DB7E033531: roundcubemail security update

FEDORA-2026-DB7E033531, released November 7, 2026, fixes 20 CVEs in roundcubemail (version 1.6.20-1.fc43). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

8.5

Base score, 0 to 10

Highest EPSS

0.0079

56th percentile

Priority of the 20 CVEs

Patch now 0
                                Urgent 0
                                High 6
                                Routine 14

Fixed package versions

Product	Release	Fixed in
roundcubemail	Fedora 43	1.6.20-1.fc43

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-114720	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability	7.1	0.0079	None reported
High	CVE-2026-114724	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unser...	8.1	0.0041	None reported
High	CVE-2026-114716	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability	8.5	0.0039	None reported
High	CVE-2026-114732	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in mul...	8.1	0.0038	None reported
High	CVE-2026-114730	roundcube: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass	7.2	0.0037	None reported
High	CVE-2026-114727	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizi...	8.3	0.0033	None reported
Routine	CVE-2026-114723	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during t...	5.3	0.0046	None reported
Routine	CVE-2026-114729	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass	5.3	0.0038	None reported
Routine	CVE-2026-114728	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handlin...	5.3	0.0037	None reported
Routine	CVE-2026-114714	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a path traversal vulnerability in the squirrelm...	5.3	0.0037	None reported
Routine	CVE-2026-114717	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a me...	5.8	0.0037	None reported
Routine	CVE-2026-114726	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bo...	5.8	0.0033	None reported
Routine	CVE-2026-114721	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed	3.1	0.0030	None reported
Routine	CVE-2026-114718	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the pas...	6.1	0.0029	None reported
Routine	CVE-2026-114725	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability	5.0	0.0028	None reported
Routine	CVE-2026-47759	roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views...	n/a	0.0028	None reported
Routine	CVE-2026-47762	roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views...	n/a	0.0028	None reported
Routine	CVE-2026-47761	roundcubemail: ## Version 1.6.20 - Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/views...	n/a	0.0026	None reported
Routine	CVE-2026-114722	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages	6.5	0.0025	None reported
Routine	CVE-2026-114719	roundcube: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk ac...	4.3	0.0022	None reported

Also fixes CVE-2026-114720

DEBIAN-CVE-2026-114720
roundcube on Debian 13.5 (trixie), Debian 14

Vendor advisory

https://bodhi.fedoraproject.org/updates/FEDORA-2026-db7e033531

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/fedora-2026-db7e033531">FEDORA-2026-DB7E033531 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.