Security release

Author: alecpl

_data/downloads.json

@@ -5,24 +5,24 @@
         "packages": [
             {
                 "package": "Dependent",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.0/roundcubemail-1.7.0.tar.gz",
-                "version": "1.7.0",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.1/roundcubemail-1.7.1.tar.gz",
+                "version": "1.7.1",
                 "size": "4.0 MB",
-                "checksum": "d84fb637e4ec36be96f98e719f65fab3c17b1dace8d2a590f948111e51847cba"
+                "checksum": "b302db11a30b99870dc5c9475cc7c4cce197acb89b8c35f51d08276fdd0d2de8"
             },
             {
                 "package": "Complete",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.0/roundcubemail-1.7.0-complete.tar.gz",
-                "version": "1.7.0",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.1/roundcubemail-1.7.1-complete.tar.gz",
+                "version": "1.7.1",
                 "size": "6.0 MB",
-                "checksum": "a34c366da2b7a24ad4a6382b4bb9a677cb581ee08bfc6304d0a9a721098e7a98"
+                "checksum": "1e0382bcefd627ab0b6285d3181ddfba5b444fdcf6d49f33f5ea15fbf97864ef"
             },
             {
                 "package": "Framework",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.0/roundcube-framework-1.7.0.tar.gz",
-                "version": "1.7.0",
-                "size": "1.1 MB",
-                "checksum": "4dab0dae47c839f1cca9daac9438d80771bb94d177aaa59dbeeb63a06e9ef4bc"
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.7.1/roundcube-framework-1.7.1.tar.gz",
+                "version": "1.7.1",
+                "size": "1.0 MB",
+                "checksum": "ca73d8709fc5c8fe0a748f49dc10db3554c35ab6a0cf5f9bf91e9edadb5513e2"
             }
         ]
     },
@@ -39,10 +39,10 @@
         "packages": [
             {
                 "package": "Complete",
-                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.15/roundcubemail-1.6.15-complete.tar.gz",
-                "version": "1.6.15",
+                "url": "https://github.com/roundcube/roundcubemail/releases/download/1.6.16/roundcubemail-1.6.16-complete.tar.gz",
+                "version": "1.6.16",
                 "size": "5.6 MB",
-                "checksum": "48c9f212c77460132491f670abaf440b765c8276268349a690913764d26afbef"
+                "checksum": "554f88f642d2d709916e9fd674239a83189a956e7258ce72a1d927c84ecd7e1a"
             },
         ]
     },

_posts/2026-05-24-security-updates-1.6.16-and-1.7.1.md

@@ -0,0 +1,24 @@
+---
+layout: article
+title: Security updates 1.6.16 and 1.7.1 released
+tags: releases updates security
+---
+
+We just published security updates to the 1.6 LTS and 1.7 versions of Roundcube Webmail.
+They both contain fixes for recently reported security vulnerabilities.
+
+## Security fixes
+
+- Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog, reported by zazy
+- Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">`, reported by wooseokdotkim
+- Fix pre-auth SQL injection in virtuser_query plugin via preg_replace backslash escape bypass, reported by skull
+- Fix SSRF bypass via specific local address URLs
+- Fix local/private URL fetch bypass when remote resources were not allowed, reported by Orange Cyberdefense Vulnerability Disclosure Team
+- Fix bypass of remote image blocking via CSS var(), reported by Geame
+- Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass, reported by valent1
+- Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option, reported by Glendaenri
+
+See the full changelogs in the release notes on the Github download pages for the updated versions
+[1.6.16](https://github.com/roundcube/roundcubemail/releases/tag/1.6.16) and [1.7.1](https://github.com/roundcube/roundcubemail/releases/tag/1.7.1).
+
+We strongly recommend to update all productive installations of Roundcube 1.6.x and 1.7.x with this new versions.