Roundcube vulnerable

[sahsanu]

@cloudknight

Is Hestia going to provide an update for this anytime soon!

I don’t know but you can update it following these instructions:

DOC: How to update Roundcube to version 1.6.14 (fixes 8 security vulnerabilities)

Hi, Today, March 18h, 2026 has been released Roundcube 1.6.14 and it fixes eight security vulnerabilities. Security fixes Fix pre-auth arbitrary file write via unsafe deserialization in redis/memcache session handler, reported by y0us. Fix bug where a password could get changed without providing the old password, reported by flydragon777. Fix IMAP Injection + CSRF bypass in mail search, reported by Martila Security Research Team. Fix remote image blocking bypass via various SVG animate attri…