{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0507",
  "published": "2026-10-15T17:19:59Z",
  "modified": "2026-10-15T17:03:48Z",
  "summary": "Updated roundcubemail package fixes security vulnerabilities",
  "details": "Fix CSS declaration smuggling via un-encoded ampersand emission,\nreported by Zach Hanley of Horizon3.ai\nFix CSS property injection via body background attribute, reported by\nzenithhostingevan\nFix email header injection via bare CR in the subject field, reported by\nCVE-Hunter-Leo\nFix email header injection via C-escape \\r in the recipient display\nname, reported by dogeshark\nFix email header injection via identity’s organization field, reported\nby dogeshark\nFix zero-click stored XSS via TNEF MIME tag injection in the attachment\nURL, reported by nakko\nFix XSS in the HTML editor using text/enriched part content, reported by\nJoshua Rogers\nFix cross-user access in contact group membership (add/remove) in the\nSQL address book, reported by Joshua Rogers\nFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL,\nreported by nept1337\nFix remote content blocking bypass via CSS escapes in FuncIRI\nattributes, reported by Wahab KHADIR\nFix remote-content blocker bypass via SVG SMIL src animation\nFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4\naddresses, reported by faceless0x7 and Harish Annavisamy\n",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0507.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36329"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES7Y7BBV2XIZNG5DARABOUMPTB5NUSFA/"
    },
    {
      "type": "WEB",
      "url": "https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "roundcubemail",
        "purl": "pkg:rpm/mageia/roundcubemail?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.4-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}