Skip to content

Release history

roundcubemail releases

The Roundcube Webmail suite

All releases

9 shown

Upgrade now
1.7.1 Security relevant
Auth RCE / SSRF Dependencies

Security updates

Upgrade now
1.6.16 Security relevant
Auth RCE / SSRF Dependencies

Security fixes

1.7.0 Breaking risk
Breaking changes
  • Dropped support for PHP < 8.1
  • Dropped support for Internet Explorer
  • Dropped support for MS SQL Server and Oracle
Notable features
  • Improved OAuth2/OIDC support (OIDC discovery, OIDC logout)
  • Markdown mail rendering and composing
  • Quick actions mouse-over menu on the messages list
Full changelog

This is the stable release of the next major version 1.7 of Roundcube Webmail.

After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality.

Some noteworthy changes are:

  • Mandatory public_html/ entry-point for HTTP servers, protecting all installations better.
  • Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout).
  • Markdown mail rendering and composing.
  • A quick actions mouse-over menu on the messages list.
  • Advanced mail search syntax.

Breaking Changes

  • Dropped support for PHP < 8.1.
  • Dropped support for Internet Explorer.
  • Dropped support for MS SQL Server and Oracle.
  • public_html/ entry-point made mandatory, all static resources are served via public_html/static.php.
  • Removed apc cache driver (replaced by apcu cache driver).
  • Changed smtp_log option default value to false.
  • Removed contact_search_name option in favor of contactlist_name_template.
  • Replaced session property changed by expires_at.
  • Removed the (insecure) virtualmin password driver.

This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. Download it from roundcube.net.

With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained.

And don't forget to backup your data before installing it!

Changelog since 1.7-rc6

  • Bump OpenPGPjs version to 6.3.0
  • Allow cidr (subnets) in proxy_whitelist (#7103)
  • Zipdownload: Fix message date time zone in mbox export (#10147)
1.6.15 Security relevant
Security fixes
  • SVG Animate FUNCIRI Attribute Bypass: Remote Image Loading via fill/filter/stroke
1.5.15 Security relevant
Security fixes
  • SVG Animate FUNCIRI Attribute Bypass: Remote Image Loading via fill/filter/stroke
1.6.14 Security relevant
Security fixes
  • Pre-auth arbitrary file write via redis/memcache deserialization
  • Password change without old password verification
  • IMAP Injection + CSRF bypass
1.5.14 Security relevant
Security fixes
  • Pre-auth arbitrary file write via redis/memcache deserialization
  • Password change without old password
  • IMAP Injection + CSRF bypass
1.6.13 Security relevant
Security fixes
  • CSS injection vulnerability
  • SVG content remote image blocking bypass
1.5.13 Security relevant
Security fixes
  • CSS injection vulnerability reported by CERT Polska
  • SVG content remote image bypass

Beta — feedback welcome: [email protected]