Skip to content

roundcubemail

Communication & Email

A browser‑based, multilingual IMAP email client written in PHP

PHP Latest 1.7.1 · 10d ago Security brief →

Features

  • Webmail interface accessible via any modern browser
  • Full‑featured IMAP client (MIME support, address book, folder management)
  • Extensible via a plugin API and customizable skins

Recent releases

View all 9 releases →
Upgrade now
1.7.1 Security relevant
Auth RCE / SSRF Dependencies

Security updates

Upgrade now
1.6.16 Security relevant
Auth RCE / SSRF Dependencies

Security fixes

1.7.0 Breaking risk
Breaking changes
  • Dropped support for PHP < 8.1
  • Dropped support for Internet Explorer
  • Dropped support for MS SQL Server and Oracle
Notable features
  • Improved OAuth2/OIDC support (OIDC discovery, OIDC logout)
  • Markdown mail rendering and composing
  • Quick actions mouse-over menu on the messages list
Full changelog

This is the stable release of the next major version 1.7 of Roundcube Webmail.

After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality.

Some noteworthy changes are:

  • Mandatory public_html/ entry-point for HTTP servers, protecting all installations better.
  • Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout).
  • Markdown mail rendering and composing.
  • A quick actions mouse-over menu on the messages list.
  • Advanced mail search syntax.

Breaking Changes

  • Dropped support for PHP < 8.1.
  • Dropped support for Internet Explorer.
  • Dropped support for MS SQL Server and Oracle.
  • public_html/ entry-point made mandatory, all static resources are served via public_html/static.php.
  • Removed apc cache driver (replaced by apcu cache driver).
  • Changed smtp_log option default value to false.
  • Removed contact_search_name option in favor of contactlist_name_template.
  • Replaced session property changed by expires_at.
  • Removed the (insecure) virtualmin password driver.

This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. Download it from roundcube.net.

With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained.

And don't forget to backup your data before installing it!

Changelog since 1.7-rc6

  • Bump OpenPGPjs version to 6.3.0
  • Allow cidr (subnets) in proxy_whitelist (#7103)
  • Zipdownload: Fix message date time zone in mbox export (#10147)
1.6.15 Security relevant
Security fixes
  • SVG Animate FUNCIRI Attribute Bypass: Remote Image Loading via fill/filter/stroke
1.5.15 Security relevant
Security fixes
  • SVG Animate FUNCIRI Attribute Bypass: Remote Image Loading via fill/filter/stroke

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
6,999
Forks
1,757
Languages
PHP JavaScript Less

Beta — feedback welcome: [email protected]