Roundcube has shipped security releases for both of its supported branches, and one of the twelve fixes in them stands out: a stored cross-site scripting bug the project labels zero-click, meaning it needs no click from the recipient to fire. Cross-site scripting means the attacker's script executes inside the victim's own webmail session, with whatever that session can reach.
Versions 1.6.19 and 1.7.4 went out on September 6 and cover the 1.6 LTS and 1.7 lines. The project recommends updating every production installation of 1.6.x and 1.7.x. Peru's national digital security center carried the advisory to Latin American administrators two days later.
Twelve ways to smuggle something past the filter
The zero-click case is a stored XSS reached by injecting a TNEF MIME tag into an attachment URL, reported by nakko. TNEF is Microsoft's old proprietary attachment format, the one that produces the winmail.dat files people still find in their inboxes, and it is exactly the kind of legacy handling path that filters tend to know least well. A second scripting bug, in the HTML editor's handling of text/enriched part content, was reported by Joshua Rogers, who also found cross-user access in contact group membership in the SQL address book, meaning one user could add or remove entries in another user's groups.
Three separate email header injection flaws were fixed, each in a different field an attacker might control: a bare carriage return in the subject line (CVE-Hunter-Leo), a C-escaped carriage return in a recipient display name, and the organization field of a user identity (both dogeshark). Header injection matters in webmail because the headers are what decide where a message actually goes.
The rest of the set is about content that was supposed to stay contained. Zach Hanley of Horizon3.ai reported CSS declaration smuggling through an un-encoded ampersand, and zenithhostingevan found CSS property injection via the body background attribute. nept1337 reported a bypass of the is_local_url() check using a trailing-dot fully qualified domain name in a stylesheet URL. Two separate bypasses of the remote content blocker were closed, one using CSS escapes in FuncIRI attributes (Wahab KHADIR) and one using SVG SMIL source animation. And faceless0x7 and Harish Annavisamy reported a server-side request forgery bypass in Roundcube's CSS proxy using hexadecimal IPv6-mapped IPv4 addresses, which is the kind of trick that turns a webmail server into a probe for whatever sits behind it.
What the release notice does not say
It publishes no CVE identifiers, no severity scores and no exploitation reports. There is nothing in it to suggest any of these bugs are being used in the wild, and nothing in it that would let anyone claim otherwise. The single-line descriptions above are all the project has published, so how far any one of them reaches in a given deployment is not something the advisory settles.
What it does settle is worth acting on anyway. Roundcube is one of the most widely deployed open-source webmail interfaces, and webmail has repeatedly proved to be the shortest route to somebody's correspondence: state-backed operators have used a zero-click Zimbra exploit to read Western email and poisoned calendar invites against SOGo in the past two months alone. A scripting bug that fires on a message the target never opens belongs in the same category of risk, whether or not anyone has reached for it yet.
Update to 1.6.19 or 1.7.4
There is no workaround offered and none is needed: apply the point release for whichever branch you run. Hosting providers with many tenant installations are the ones with real work here, since the exposure sits on every instance rather than on one server, and the zero-click case does not wait for a user to be careless.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.