Advisories » MGASA-2026-0507

Updated roundcubemail package fixes security vulnerabilities

Publication date: 15 Oct 2026
Modification date: 15 Oct 2026
Type: security
Affected Mageia releases : 10

Description

Fix CSS declaration smuggling via un-encoded ampersand emission,
reported by Zach Hanley of Horizon3.ai
Fix CSS property injection via body background attribute, reported by
zenithhostingevan
Fix email header injection via bare CR in the subject field, reported by
CVE-Hunter-Leo
Fix email header injection via C-escape \r in the recipient display
name, reported by dogeshark
Fix email header injection via identity’s organization field, reported
by dogeshark
Fix zero-click stored XSS via TNEF MIME tag injection in the attachment
URL, reported by nakko
Fix XSS in the HTML editor using text/enriched part content, reported by
Joshua Rogers
Fix cross-user access in contact group membership (add/remove) in the
SQL address book, reported by Joshua Rogers
Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL,
reported by nept1337
Fix remote content blocking bypass via CSS escapes in FuncIRI
attributes, reported by Wahab KHADIR
Fix remote-content blocker bypass via SVG SMIL src animation
Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4
addresses, reported by faceless0x7 and Harish Annavisamy

References

SRPMS

10/core