MGASA-2026-0333: roundcubemail Mageia

Vulnerability summary

MGASA-2026-0333 is a vulnerability in roundcubemail Mageia with no CVSS score yet.

Timeline

1. 13-08-2026
   PublishedVulnerability first disclosed.
2. 13-08-2026
   Last modifiedVulnerability information updated.

Description

Updated roundcubemail packages fix security vulnerabilities Add basic validation for content proxied by the css proxy Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets, Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the search_filter Fix arbitrary Sieve script injection via a filter rule name bypassing managesieve_disabled_actions Fix RCE via cmd_learn driver of markasjunk plugin Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization Fix password's modoboa driver leak of an authentication token to a user-controlled host Fix stored XSS in "Add to address book" action Fix HTML/CSS sanitization bypass via SVG animate by attribute

No weakness data has been published for this record.