Roundcube security fix 1.7.1 / 1.6.16

[maurice]

Roundcube has released a security update for the 1.7 and 1.6 branch, 1.71 and 1.6.16

If you are at the 1.6 branch, you can update to 1.6.16 by using these instructions as a guide. Just be sure to change to 1.6.16 where appropriate.

[jperkins]

thanks . worked for me. went from 1.6.14 to 1.6.16

[nu01]

There is a thread already running:

DOC: How to update Roundcube to version 1.6.14 (fixes 8 security vulnerabilities)

Hi, Today, March 18h, 2026 has been released Roundcube 1.6.14 and it fixes eight security vulnerabilities. Security fixes Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. Fix bug where a password could get changed without providing the old password, reported by flydragon777. Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. Fix remote image blocking bypass via various SVG animate attri…

I upgraded to 1.7.1

DOC: How to update Roundcube to version 1.6.14 (fixes 8 security vulnerabilities)

I upgraded to 1.7.1 sed -E -i "s/^rc_v='1.*/rc_v='1.7.1'/" /usr/local/hestia/install/upgrade/upgrade.conf sed -i -E 's/(^disable_functions.*),proc_open(.*$)/\1\2/' /etc/php/$(php -v | head -n1 | grep -o '[0-9]\.[0-9]')/cli/php.ini sed -i -E 's/(^disable_functions.*),system(.*$)/\1\2/' /etc/php/$(php -v | head -n1 | grep -o '[0-9]\.[0-9]')/cli/php.ini v-add-sys-roundcube cd /var/lib/roundcube/ COMPOSER_ALLOW_SUPERUSER=1 composer -n update If composer not found, then: v-add-user-composer ad…