FEDORA-2026-DB7E033531: roundcubemail security update

FEDORA-2026-DB7E033531, released November 7, 2026, fixes 20 CVEs in roundcubemail (version 1.6.20-1.fc43). None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Highest CVSS

8.5

Base score, 0 to 10

Highest EPSS

0.0079

56th percentile

Priority of the 20 CVEs

Patch now 0
                                Urgent 0
                                High 6
                                Routine 14

Fixed package versions

Product	Release	Fixed in
roundcubemail	Fedora 43	1.6.20-1.fc43

CVEs this fix closes

Priority	CVE	Title	CVSS	EPSS	Exploitation
High	CVE-2026-114720	roundcubemail: roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection in the _flag parameter	7.1	0.0079	None reported
High	CVE-2026-114724	roundcubemail: roundcubemail: roundcubemail: Arbitrary code execution via session object injection	8.1	0.0041	None reported
High	CVE-2026-114716	roundcubemail: roundcubemail: roundcubemail: Mail header injection via unvalidated inline image media type	8.5	0.0039	None reported
High	CVE-2026-114732	roundcubemail: roundcubemail: roundcubemail: Unauthorized account access via alias login in multi-host environments	8.1	0.0038	None reported
High	CVE-2026-114730	roundcubemail: roundcubemail: roundcubemail: Server-Side Request Forgery via address filter bypass	7.2	0.0037	None reported
High	CVE-2026-114727	roundcubemail: roundcubemail: roundcubemail: Arbitrary code execution via unsafe image resizing	8.3	0.0033	None reported
Routine	CVE-2026-114723	roundcubemail: roundcubemail: roundcubemail: Denial of Service (DoS) via memory exhaustion during thumbnail generation	5.3	0.0046	None reported
Routine	CVE-2026-114729	roundcubemail: roundcubemail: roundcubemail: Information disclosure via SVG SMIL remote content blocking bypass	5.3	0.0038	None reported
Routine	CVE-2026-114728	roundcubemail: roundcubemail: roundcubemail: Remote content blocking bypass via crafted CSS escape sequences	5.3	0.0037	None reported
Routine	CVE-2026-114714	roundcubemail: roundcubemail: roundcubemail: Information disclosure via path traversal in squirrelmail_usercopy plugin	5.3	0.0037	None reported
Routine	CVE-2026-114717	roundcubemail: roundcubemail: roundcubemail: Mail header injection via forwarded message subject	5.8	0.0037	None reported
Routine	CVE-2026-114726	roundcubemail: roundcubemail: roundcubemail: Mail header injection via crafted From display name in bounce action	5.8	0.0033	None reported
Routine	CVE-2026-114721	roundcubemail: roundcubemail: roundcubemail: Security restriction bypass via deprecated action aliases	3.1	0.0030	None reported
Routine	CVE-2026-114718	roundcubemail: roundcubemail: roundcubemail: Cross-site scripting via unescaped password driver error messages	6.1	0.0029	None reported
Routine	CVE-2026-114725	roundcubemail: roundcubemail: roundcubemail: Arbitrary mail header injection via unsanitized request parameters	5.0	0.0028	None reported
Routine	CVE-2026-47759	roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes	n/a	0.0028	None reported
Routine	CVE-2026-47762	roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability through mce:protected comments	n/a	0.0028	None reported
Routine	CVE-2026-47761	roundcubemail: roundcubemail: Cross-Site Scripting (XSS) vulnerability using media plugin data-mce-object injection	n/a	0.0026	None reported
Routine	CVE-2026-114722	roundcubemail: roundcubemail: Roundcube Webmail: Interface spoofing via CSS scoping bypass in HTML messages	6.5	0.0025	None reported
Routine	CVE-2026-114719	roundcubemail: roundcubemail: roundcubemail: CSRF validation bypass via markasjunk plugin	4.3	0.0022	None reported

Also fixes CVE-2026-114720

DEBIAN-CVE-2026-114720
roundcube on Debian 13.5 (trixie), Debian 14

Vendor advisory

https://bodhi.fedoraproject.org/updates/FEDORA-2026-db7e033531

For tools and AI agents

This page as data: JSON · Markdown

Link to this page

If this page saved you time, a link to it in your ticket, advisory or write-up helps others find it.

HTML

<a href="https://patchblox.com/security/fix/linux/fedora-2026-db7e033531">FEDORA-2026-DB7E033531 on Patchblox Patch Radar</a>

Reusing the data? How to credit Patch Radar.

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.