{"id":"MGASA-2026-0507","summary":"Updated roundcubemail package fixes security vulnerabilities","details":"Fix CSS declaration smuggling via un-encoded ampersand emission,\nreported by Zach Hanley of Horizon3.ai\nFix CSS property injection via body background attribute, reported by\nzenithhostingevan\nFix email header injection via bare CR in the subject field, reported by\nCVE-Hunter-Leo\nFix email header injection via C-escape \\r in the recipient display\nname, reported by dogeshark\nFix email header injection via identity’s organization field, reported\nby dogeshark\nFix zero-click stored XSS via TNEF MIME tag injection in the attachment\nURL, reported by nakko\nFix XSS in the HTML editor using text/enriched part content, reported by\nJoshua Rogers\nFix cross-user access in contact group membership (add/remove) in the\nSQL address book, reported by Joshua Rogers\nFix is_local_url() bypass via trailing-dot FQDN in stylesheet URL,\nreported by nept1337\nFix remote content blocking bypass via CSS escapes in FuncIRI\nattributes, reported by Wahab KHADIR\nFix remote-content blocker bypass via SVG SMIL src animation\nFix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4\naddresses, reported by faceless0x7 and Harish Annavisamy\n","modified":"2026-10-15T17:23:04.738980830Z","published":"2026-10-15T17:19:59Z","references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2026-0507.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=36329"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ES7Y7BBV2XIZNG5DARABOUMPTB5NUSFA/"},{"type":"WEB","url":"https://roundcube.net/news/2026/09/06/security-updates-1.6.19-and-1.7.4"}],"affected":[{"package":{"name":"roundcubemail","ecosystem":"Mageia:10","purl":"pkg:rpm/mageia/roundcubemail?arch=source&distro=mageia-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.4-1.mga10"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2026-0507.json"}}],"schema_version":"1.9.0","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}