Skip to content

roundcubemail

Communication & Email

A browser‑based, multilingual IMAP email client written in PHP

PHP Latest 1.6.17 · 21d ago Security brief →

Features

  • Multilingual webmail interface with application‑like UX
  • Full IMAP support including MIME, address book and folder management
  • Extensible via a plugin API and customizable skins

Recent releases

View all 11 releases →
Upgrade now
1.6.17 Security relevant
Auth RCE / SSRF

Security fixes for winmail.dat, Enigma, SRUKR

Upgrade now
1.7.2 Security relevant
Auth RCE / SSRF

CVE fixes

Upgrade now
1.7.1 Security relevant
Auth RCE / SSRF Dependencies

Security updates

Upgrade now
1.6.16 Security relevant
Auth RCE / SSRF Dependencies

Security fixes

1.7.0 Breaking risk
Breaking changes
  • Dropped support for PHP < 8.1
  • Dropped support for Internet Explorer
  • Dropped support for MS SQL Server and Oracle
Notable features
  • Improved OAuth2/OIDC support (OIDC discovery, OIDC logout)
  • Markdown mail rendering and composing
  • Quick actions mouse-over menu on the messages list
Full changelog

This is the stable release of the next major version 1.7 of Roundcube Webmail.

After almost four years of development we introduce a few breaking changes, some new features, and bring support for recent PHP versions. With automated code style and quality checks, removed code bloat and updated dependencies, we hope for even more codebase quality.

Some noteworthy changes are:

  • Mandatory public_html/ entry-point for HTTP servers, protecting all installations better.
  • Improved OAuth2/OIDC support (e.g. support for OIDC discovery, OIDC logout).
  • Markdown mail rendering and composing.
  • A quick actions mouse-over menu on the messages list.
  • Advanced mail search syntax.

Breaking Changes

  • Dropped support for PHP < 8.1.
  • Dropped support for Internet Explorer.
  • Dropped support for MS SQL Server and Oracle.
  • public_html/ entry-point made mandatory, all static resources are served via public_html/static.php.
  • Removed apc cache driver (replaced by apcu cache driver).
  • Changed smtp_log option default value to false.
  • Removed contact_search_name option in favor of contactlist_name_template.
  • Replaced session property changed by expires_at.
  • Removed the (insecure) virtualmin password driver.

This release is considered stable and we encourage you to update your productive installations after carefully testing the upgrade scenario. Download it from roundcube.net.

With the release of Roundcube 1.7.0, the previous stable release branch 1.6.x changes into an LTS (low maintenance) mode which means it will only receive important security updates. The 1.5.x series is no longer supported and maintained.

And don't forget to backup your data before installing it!

Changelog since 1.7-rc6

  • Bump OpenPGPjs version to 6.3.0
  • Allow cidr (subnets) in proxy_whitelist (#7103)
  • Zipdownload: Fix message date time zone in mbox export (#10147)

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

About

Stars
7,090
Forks
1,764
Languages
PHP JavaScript Less

Beta — feedback welcome: [email protected]