Roundcube patches 11 flaws without CVEs, cPanel lags update

Roundcube, the open-source webmail client widely deployed in shared hosting environments, released security updates for its current and long-term support (LTS) branches on August 9. The updates, versions 1.7.3 and 1.6.18, address 11 vulnerabilities but include no Common Vulnerabilities and Exposures (CVE) identifiers, complicating detection for hosting providers that rely on automated vulnerability scanners. cPanel, which distributes Roundcube as part of its control panel software, has not yet incorporated the fixes into its bundled package, leaving fleets dependent on its update cycle exposed for days or weeks.

What the fixes address

The 11 vulnerabilities span a range of attack vectors, though none are reported as actively exploited. The most severe, a remote code execution (RCE) flaw in the markasjunk plugin’s cmd_learn driver, requires specific configuration to be exploitable. The plugin is not enabled by default, and the driver executes external commands like salearn, meaning exposure depends on individual host setups rather than Roundcube’s presence alone.

The most broadly applicable issue is an IMAP command injection vulnerability discovered by Zach Hanley of Horizon3.ai. The flaw stems from a desynchronization in LITERAL+ handling during mail searches, allowing attackers to inject commands through a seemingly innocuous search box. Other fixes address server-side request forgery (SSRF) bypasses, LDAP filter injection, arbitrary Sieve script injection, and multiple content-handling flaws, including stored cross-site scripting (XSS) and sanitization bypasses via SVG attributes.

Two researchers stand out in the credits: Milan Hoppe, who reported four of the 11 issues, and Paulos Yibelo of pwn.ai, who identified the stored XSS flaw. Yibelo’s firm was also credited for a separate vulnerability in WordPress 7.0.3 last week, though the advisories do not indicate whether the same attack method was reused.

Detection and deployment challenges

The absence of CVE identifiers creates operational blind spots for hosting providers. Vulnerability scanners, compliance tools, and patch management systems typically rely on CVE numbers to flag affected software versions. Without them, fleets must manually track Roundcube releases or wait for panel vendors like cPanel to integrate updates. The project’s July security releases included CVEs, suggesting the omission in August may be an oversight rather than a policy change, but the effect is the same: fleets cannot automate detection of these flaws.

cPanel’s update lag compounds the problem. The company ships Roundcube as the cpanel-roundcubemail package, tracking the 1.6 LTS branch. Historical data shows delays of five to nine days between Roundcube’s security releases and cPanel’s integration. As of August 10, the latest cPanel build (134.0.49, released August 5) predates Roundcube’s August 9 update, meaning providers waiting for cPanel’s package remain exposed. Debian’s stable release, which carries Roundcube 1.6.17, further lags, relying on backported fixes that obscure the upstream version number.

Broader context

Roundcube’s security release frequency has accelerated in 2026, with five updates to the 1.6 branch since March and three to the 1.7 branch since its May launch. The pace reflects the inherent risks of webmail software, which processes untrusted content from external sources by design. While none of the recent flaws are known to be exploited, the steady stream of fixes underscores the need for more frequent maintenance cycles than many fleets currently allocate.

The lack of severity ratings for individual vulnerabilities adds another layer of complexity. Without standardized scoring, providers must assess risk based on their own configurations, making blanket policies like "patch all critical flaws within 48 hours" difficult to apply. The project’s flat disclosure style leaves prioritization to operators, who may lack the context to triage effectively.