Medium DSA-6137-1 2 CVEs

roundcube - security update

Published Feb 17, 2026 · Updated Feb 17, 2026

Ecosystem: Debian

Fixed packages 2

Release	Package	Fixed in
Debian · 12	roundcube	1.6.5+dfsg-1+deb12u7
Debian · 13	roundcube	1.6.13+dfsg-0+deb13u1

Vulnerabilities 2

Medium 4.7

CVE-2026-26079

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13 allows Cascading Style Sheets (CSS) injection, e.g., because comm…

Roundcube Webmail roundcube roundcube Debian Ubuntu

Feb 11, 2026
Medium 4.3

CVE-2026-25916 Public exploit

Roundcube Webmail before 1.5.13 and 1.6 before 1.6.13, when "Block remote images" is used, does not block SVG feImage.

Roundcube Webmail roundcube roundcube Debian Ubuntu

Feb 9, 2026