# Roundcube 1.2.13: actively exploited

Attackers are using a vulnerability in this version right now. Upgrade immediately.

- Recommended: 1.6.20 (lowest fixed release that is still supported)
- Known vulnerabilities: 17 (1 critical, 3 high, 11 medium, 2 low)
- End of life: yes, since 2021-10-18 (release line 1.2)
- Data as of: 2026-10-24 20:37 UTC

## Vulnerabilities

| ID | Severity | Actively exploited | Fixed in |
|---|---|---|---|
| [CVE-2025-49113](https://roundcube.net/news/2025/06/01/security-updates-1.6.11-and-1.5.10) | critical | yes | 1.5.10 |
| [CVE-2025-68461](https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12) | high | yes | 1.5.12 |
| [CVE-2020-13965](https://www.debian.org/security/2020/dsa-4700) | medium | yes | 1.3.12 |
| [CVE-2024-37383](https://github.com/roundcube/roundcubemail/commit/43aaaa528646877789ec028d87924ba1accf5242) | medium | yes | 1.5.7 |
| [CVE-2023-43770](https://github.com/roundcube/roundcubemail/commit/e92ec206a886461245e1672d8530cc93c618a49b) | medium | yes | 1.4.14 |
| [CVE-2024-42010](https://github.com/roundcube/roundcubemail/releases) | high | no | — |
| [CVE-2025-68460](https://roundcube.net/news/2025/12/13/security-updates-1.6.12-and-1.5.12) | high | no | 1.5.12 |
| [CVE-2026-35539](https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14) | medium | no | 1.5.14 |
| [CVE-2026-35545](https://roundcube.net/news/2026/03/29/security-updates-1.7-rc6-1.6.15-1.5.15) | medium | no | 1.5.15 |
| [CVE-2026-35544](https://roundcube.net/news/2026/03/18/security-updates-1.7-rc5-1.6.14-1.5.14) | medium | no | 1.5.14 |

And 7 more with lower severity.

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.

---

FixedIn gives information, not guarantees. Always confirm with the vendor's advisory before you rely on a result. Source: https://fixedin.dev/roundcube/1.2.13 · JSON: https://fixedin.dev/roundcube/1.2.13.json · MCP server: https://fixedin.dev/mcp · About these addresses: https://fixedin.dev/llms.txt