Roundcube 1.3.17 Actively exploited

Attackers are using a vulnerability in this version right now. Upgrade immediately.

Upgrade to 1.6.20

The lowest fixed release that is still supported.

Known vulnerabilities

16 (1 critical, 3 high)

End of life

Yes, since 2022-07-28

Data as of

2026-10-24 23:07 UTC

Vulnerabilities

• CVE-2025-49113 critical exploited fixed in 1.5.10
• CVE-2025-68461 high exploited fixed in 1.5.12
• CVE-2024-37383 medium exploited fixed in 1.5.7
• CVE-2023-43770 medium exploited fixed in 1.4.14
• CVE-2024-42010 high
• CVE-2025-68460 high fixed in 1.5.12
• CVE-2026-35539 medium fixed in 1.5.14
• CVE-2026-35545 medium fixed in 1.5.15
• CVE-2026-35544 medium fixed in 1.5.14
• CVE-2026-35543 medium fixed in 1.5.14

And 6 more with lower severity.

Installed with apt, yum or another package manager? Your distribution may already have patched this without changing the version, so check its security tracker too.