selfhost.directory on Nostr: 🚀 New release · Roundcube Webmail 1.6.17 This is a security update to the LTS ...
🚀 New release · Roundcube Webmail 1.6.17
This is a security update to the LTS version 1.6 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
• Fix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.
• Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.
• Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R&D Instit
Check and self-host it →
https://selfhost.directory/project/roundcube#update-2562504 
Published at
2026-07-05 11:22:02 UTCEvent JSON
{
"id": "d22ad9c7847633ddcb86cf86c6f6f28b521c2a26e0b196daafe7d931ab5f18f2",
"pubkey": "80e8f63915c8d718c20c5a281cf7847ffef267e926c7b4fdd9e66961748b681b",
"created_at": 1783250522,
"kind": 1,
"tags": [],
"content": "🚀 New release · Roundcube Webmail 1.6.17\n\nThis is a security update to the LTS version 1.6 of Roundcube Webmail.\nIt provides fixes to recently reported security vulnerabilities:\n• Fix an infinite loop in TNEF (winmail.dat) decoder (#10193), reported by stafra.\n• Fix various vulnerabilities in the password plugin using session-injected username, reported by Glendaenri and peppersghost.\n• Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432], reported by Bohdan Kurinnoy, Samsung R\u0026D Instit\n\nCheck and self-host it → https://selfhost.directory/project/roundcube#update-2562504\n\nhttps://selfhost.directory/_og/d/c_SelfhostDirectory,title_Roundcube+Webmail,description_~Um91bmRjdWJlIFdlYm1haWwgaXMgYSBmcmVlIGFuZCBvcGVuLXNvdXJjZSB3ZWJtYWlsIHNvbHV0aW9uIHRoYXQgcHJvdmlkZXMgYSBkZXNrdG9wLWxpa2UgdXNlciBpbnRlcmZhY2UgZm9yIG1hbmFnaW5nIGVtYWlsLiBJdCBpcyB3cml0dGVuIGluIFBIUCBhbmQgc3VwcG9ydOKApg,p_Ii9wcm9qZWN0L3JvdW5kY3ViZSI.png",
"sig": "674f685b6502c66b5fc0c6b35e56e3a6e26a8baeead885158129e39b6eccb39d692d835db0e6409929abb3a628c3c387ef6170c70d57a7d956e62668e2f844d0"
}
