# FEDORA-2026-DB7E033531: roundcubemail security update

FEDORA-2026-DB7E033531, released November 7, 2026, fixes 20 CVEs in roundcubemail (version 1.6.20-1.fc43). None of them is reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/fix/linux/fedora-2026-db7e033531
- Platform: Linux
- Released: Nov 7, 2026
- Priority: High (Closes CVE-2026-114720, high severity)
- CVEs: 20, exploited: 0, on CISA KEV: 0
- Vendor advisory: https://bodhi.fedoraproject.org/updates/FEDORA-2026-db7e033531

## Applies to

| Product | Release | Fixed in |
|---|---|---|
| [roundcubemail](https://patchblox.com/security/data/product/linux/roundcubemail.md) | Fedora 43 | 1.6.20-1.fc43 |

## CVEs this fix closes

| CVE | Priority | Title | CVSS | EPSS | Exploitation |
|---|---|---|---:|---:|---|
| [CVE-2026-114720](https://patchblox.com/security/data/cve/CVE-2026-114720.md) | High | roundcubemail: roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection in the _flag parameter | 7.1 | 0.0079 |  |
| [CVE-2026-114724](https://patchblox.com/security/data/cve/CVE-2026-114724.md) | High | roundcubemail: roundcubemail: roundcubemail: Arbitrary code execution via session object injection | 8.1 | 0.0041 |  |
| [CVE-2026-114716](https://patchblox.com/security/data/cve/CVE-2026-114716.md) | High | roundcubemail: roundcubemail: roundcubemail: Mail header injection via unvalidated inline image media type | 8.5 | 0.0039 |  |
| [CVE-2026-114732](https://patchblox.com/security/data/cve/CVE-2026-114732.md) | High | roundcubemail: roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments | 8.1 | 0.0038 |  |
| [CVE-2026-114730](https://patchblox.com/security/data/cve/CVE-2026-114730.md) | High | roundcubemail: roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass | 7.2 | 0.0037 |  |
| [CVE-2026-114727](https://patchblox.com/security/data/cve/CVE-2026-114727.md) | High | roundcubemail: roundcubemail: roundcubemail: Arbitrary code execution via unsafe image resizing | 8.3 | 0.0033 |  |
| [CVE-2026-114723](https://patchblox.com/security/data/cve/CVE-2026-114723.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Denial of Service (DoS) via memory exhaustion during thumbnail generation | 5.3 | 0.0046 |  |
| [CVE-2026-114729](https://patchblox.com/security/data/cve/CVE-2026-114729.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass | 5.3 | 0.0038 |  |
| [CVE-2026-114728](https://patchblox.com/security/data/cve/CVE-2026-114728.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Remote content blocking bypass via crafted CSS escape sequences | 5.3 | 0.0037 |  |
| [CVE-2026-114714](https://patchblox.com/security/data/cve/CVE-2026-114714.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Information disclosure via path traversal in squirrelmail_usercopy plugin | 5.3 | 0.0037 |  |
| [CVE-2026-114717](https://patchblox.com/security/data/cve/CVE-2026-114717.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Mail header injection via forwarded message subject | 5.8 | 0.0037 |  |
| [CVE-2026-114726](https://patchblox.com/security/data/cve/CVE-2026-114726.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action | 5.8 | 0.0033 |  |
| [CVE-2026-114721](https://patchblox.com/security/data/cve/CVE-2026-114721.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Security restriction bypass via deprecated action aliases | 3.1 | 0.0030 |  |
| [CVE-2026-114718](https://patchblox.com/security/data/cve/CVE-2026-114718.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Cross-site scripting via unescaped password driver error messages | 6.1 | 0.0029 |  |
| [CVE-2026-114725](https://patchblox.com/security/data/cve/CVE-2026-114725.md) | Routine | roundcubemail: roundcubemail: roundcubemail: Arbitrary mail header injection via unsanitized request parameters | 5.0 | 0.0028 |  |
| [CVE-2026-47759](https://patchblox.com/security/data/cve/CVE-2026-47759.md) | Routine | roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes | n/a | 0.0028 |  |
| [CVE-2026-47762](https://patchblox.com/security/data/cve/CVE-2026-47762.md) | Routine | roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability through mce:protected comments | n/a | 0.0028 |  |
| [CVE-2026-47761](https://patchblox.com/security/data/cve/CVE-2026-47761.md) | Routine | roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object injection | n/a | 0.0026 |  |
| [CVE-2026-114722](https://patchblox.com/security/data/cve/CVE-2026-114722.md) | Routine | roundcubemail: roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages | 6.5 | 0.0025 |  |
| [CVE-2026-114719](https://patchblox.com/security/data/cve/CVE-2026-114719.md) | Routine | roundcubemail: roundcubemail: roundcubemail: CSRF validation bypass via markasjunk plugin | 4.3 | 0.0022 |  |

---

Data as of 2026-11-11T07:45:43Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.