Updated roundcubemail package fixes security vulnerabilities

{
  "id": "358b18982de7e22abbdefaf6e3665788b113711223b1f9c123a6294fe7f4db78",
  "url": "https://osv.dev/vulnerability/MGASA-2026-0532",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Updated roundcubemail package fixes security vulnerabilities",
    "summary": "* Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab “NeoX” K. * Fix bug where an alias login wasn’t qualified by IMAP host, reported by Milan Hoppe. * Add a size limit to the CSS proxy content processing, reported by Milan Hoppe. * Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect. * Fix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe. * Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe. * Fix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo * Fix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay. * Fix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy. * Fix object injection primitive in rcube_session::unserialize() via “!”-prefixed session keys, reported by Oli Z. * Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW. * Fix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW. * Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. * Fix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5. * Fix CSRF validation bypass in the ",
    "evidence": "osv:MGASA-2026-0532",
    "products": [
      {
        "name": {
          "value": "roundcubemail",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "1.7.5-1.mga10",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MGASA-2026-0532",
      "aliases": [
        "MGASA-2026-0532"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1.7.5-1.mga10"
                }
              ]
            }
          ],
          "package": {
            "name": "roundcubemail",
            "purl": "pkg:rpm/mageia/roundcubemail?arch=source&distro=mageia-10",
            "ecosystem": "Mageia:10"
          },
          "database_specific": {
            "source": "https://advisories.mageia.org/MGASA-2026-0532.json"
          },
          "ecosystem_specific": {
            "section": "core"
          }
        }
      ],
      "modified": "2026-10-23T06:01:01.534593507Z",
      "provider": "osv",
      "references": [
        "https://advisories.mageia.org/MGASA-2026-0532.html",
        "https://bugs.mageia.org/show_bug.cgi?id=36552",
        "https://www.openwall.com/lists/oss-security/2026/10/20/10",
        "https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5"
      ]
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 412418,
  "published_at": "2026-10-23T05:45:46+00:00"
}