{
  "schema_version": "1.7.0",
  "id": "MGASA-2026-0532",
  "published": "2026-10-23T05:45:46Z",
  "modified": "2026-10-23T05:32:26Z",
  "summary": "Updated roundcubemail package fixes security vulnerabilities",
  "details": "* Fix IMAP command injection via CRLF in _uid parameter of mail/headers\n  and mail/viewsource action, reported by Wahab “NeoX” K.\n* Fix bug where an alias login wasn’t qualified by IMAP host, reported\n  by Milan Hoppe.\n* Add a size limit to the CSS proxy content processing, reported by\n  Milan Hoppe.\n* Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96,\n  reported by dizconnect.\n* Fix remote content blocking bypass via SVG SMIL by attribute,\n  reported by Milan Hoppe.\n* Fix remote content blocking bypass via CSS escapes in FuncIRI\n  attributes (again), reported by Milan Hoppe.\n* Fix passing potentally unsafe attachment content into ImageMagick on\n  image resize, reported by Paulos Yibelo\n* Fix mail header injection via the From display-name in the Bounce\n  (resend) action, reported by Clay.\n* Fix mail header injection via References/In-Reply-To/Message-ID/From\n  parameters, reported by Sunil Tripathy.\n* Fix object injection primitive in rcube_session::unserialize() via\n  “!”-prefixed session keys, reported by Oli Z.\n* Fix ImageMagick resource limits bypass by GD fallback during\n  thumbnail generation, reported by GoldenSW.\n* Fix CSS scoping bypass in HTML messages using at-rules, reported by\n  GoldenSW.\n* Fix bug where deprecated action aliases bypassed disabled_actions\n  setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix IMAP command injection via CRLF in _flag parameter of mail/mark\n  action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix CSRF validation bypass in the mark-as-junk action, reported by\n  Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix XSS issue in handling of password driver error responses,\n  reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix mail header injection via subject of a message forwarded as\n  attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix mail header injection via media type in an inline image data\n  URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix bug where Password Modoboa driver could change password for\n  another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n* Fix unsafe use of a login name in SquirrelMail import file path,\n  reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.\n",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://advisories.mageia.org/MGASA-2026-0532.html"
    },
    {
      "type": "REPORT",
      "url": "https://bugs.mageia.org/show_bug.cgi?id=36552"
    },
    {
      "type": "WEB",
      "url": "https://www.openwall.com/lists/oss-security/2026/10/20/10"
    },
    {
      "type": "WEB",
      "url": "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Mageia:10",
        "name": "roundcubemail",
        "purl": "pkg:rpm/mageia/roundcubemail?arch=source&distro=mageia-10"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.7.5-1.mga10"
            }
          ]
        }
      ],
      "ecosystem_specific": {
        "section": "core"
      }
    }
  ],
  "credits": [
    {
      "name": "Mageia",
      "type": "COORDINATOR",
      "contact": [
        "https://wiki.mageia.org/en/Packages_Security_Team"
      ]
    }
  ]
}