SakerCP SKSA-2026-001 Webmail (Roundcube)
- Published
- 2026-10-24
- Updated
- 2026-10-24
- Component
- Webmail (Roundcube)
- Severity
- High
- Status
- Fixed: update
- CVE
- none assigned yet
- Affected
- SakerCP with Roundcube 1.7.4: every version before 0.1.0-0.202610241714.git043c4ff79ca2.
- Fixed in
SakerCP 0.1.0-0.202610241714.git043c4ff79ca2
Summary
Roundcube 1.7.5, the security release published by the Roundcube team on 19 Oct 2026, fixes several webmail vulnerabilities: IMAP command injection, mail header injection, object injection in the session, bypasses of remote content blocking and of the SSRF filter, and unchecked attachments passed to ImageMagick.
Details
SakerCP installs Roundcube from the official release, with the Roundcube team's GPG signature verified, in its own PHP-FPM pool running as a webmail-only user, without process-launching functions and on a separate origin (:2096). This limits the reach of these vulnerabilities but does not remove them: the fix is to install 1.7.5.
What to do
None, if automatic updates are on (the default): the fixed version installs itself and replaces Roundcube. To install it now: sakercp-update as root. To check: grep RCMAIL_VERSION /opt/sakercp/share/roundcube/program/include/iniset.php should show 1.7.5.
Timeline
- The Roundcube team releases 1.7.5.
- Our daily watch detects the new release; 1.7.5 goes into SakerCP and is installed in the lab.
- In the lab, the update left the webmail failing (a permissions problem in our installer, not in Roundcube); fixed and tested before any server received it.
- Full test suite green in the lab (mail, webmail, phpMyAdmin, sites, PHP, DNS). Fix released as a critical update: servers with automatic updates install it within minutes.