Roundcube Webmail 1.3
Roundcube Webmail 1.3
The Roundcube Webmail 1.3 reached end of service life on Jul 28, 2022 — Roundcube Webmail no longer ships security patches or fixes for it. Our third-party support keeps it safe to run: 24/7 engineers manage issues, remediate vulnerabilities, and help you maintain compliance.
24/7 engineers own your Roundcube Webmail 1.3 incidents end to end.
Mitigation and patch-around guidance when the vendor no longer ships fixes.
Controls evidence and documentation that keep auditors satisfied.
Specifications
- product
- roundcube
- release
- 1.3
- product Label
- Roundcube Webmail
- release Label
- 1.3
- codename
- lts
- latest Version
- 1.3.17
- release Date
- 2017-06-26
- maintained
- source Url
- https://endoflife.date/roundcube
Lifecycle Dates
- End of Service Life
- Jul 28, 2022
- Last OEM Support
- Jul 28, 2022
OEM vs. 3rd Party Support
See how third-party support compares to the vendor contract for Roundcube Webmail 1.3 — monitoring, break/fix, vulnerability work, operations and compliance, before and after EOSL.
| Feature | OEM Support | 3rd Party Support |
|---|---|---|
| Post-EOSL Support | ||
| Break/Fix Support | Until EOSL | |
| 24/7 Monitoring | ||
| Vulnerability Scanning & Remediation | ||
| Managed Operations | ||
| Procedure & Configuration Review | ||
| Compliance & Audit Documentation | Limited | |
| Discounted Migration to Other Platforms |
Why Choose 3rd Party Support for Roundcube Webmail 1.3?
Vulnerability Remediation
Scanning, mitigation and patch-around guidance for Roundcube Webmail 1.3 when the vendor no longer ships fixes.
Compliance Maintenance
Procedure review, controls evidence and the documentation auditors ask for — maintained continuously, not scrambled at audit time.
24/7 Expert Support
Engineers who know this release monitor, manage and fix issues around the clock — break/fix to managed operations.
Roundcube Webmail 1.3 Support: Frequently Asked Questions
Is the Roundcube Webmail 1.3 still supported?
Roundcube Webmail ended support for the Roundcube Webmail 1.3 on Jul 28, 2022 — no more patches or fixes from the vendor. Third-party support keeps it covered: our engineers manage issues, remediate vulnerabilities, and help you maintain compliance for as long as you run it.
When is the Roundcube Webmail 1.3 end of service life (EOSL) date?
Roundcube Webmail lists the end of service life for the Roundcube Webmail 1.3 as Jul 28, 2022.
Can I keep using the Roundcube Webmail 1.3 after its EOSL date?
Yes. EOSL means Roundcube Webmail stops issuing patches and support — the software itself keeps running. Third-party support covers it from there: issue management, security vulnerability remediation, and the compliance documentation auditors ask for, for as long as you choose to run it.
How much does third-party support for the Roundcube Webmail 1.3 cost?
Typically 40-70% below the OEM maintenance renewal price. Exact pricing depends on quantity, service level and location — request a quote and we respond within 24 hours.
Known Vulnerabilities Affecting Roundcube Webmail 1.3
41 published CVEs affect the Roundcube Webmail 1.3, including 15 rated critical or high severity. Roundcube Webmail no longer ships security patches for this release — our engineers provide mitigation guidance, workarounds and hardening support.
| CVE | Severity | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2025-49113 | CRITICAL | 9.9 | Jun 2, 2025 | Roundcube Webmail before 1.5.10 and 1.6.x before 1.6.11 allows remote code execution by authenticated users because the _from parameter in a URL is not validated in program/actions/settings/upload.php, leading to PHP Object Deserialization. |
| CVE-2024-37385 | CRITICAL | 9.8 | Jun 7, 2024 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641. |
| CVE-2021-44026 | CRITICAL | 9.8 | Nov 19, 2021 | Roundcube before 1.3.17 and 1.4.x before 1.4.12 is prone to a potential SQL injection via search or search_params. |
| CVE-2020-12641 | CRITICAL | 9.8 | May 4, 2020 | rcube_image.php in Roundcube Webmail before 1.4.4 allows attackers to execute arbitrary code via shell metacharacters in a configuration setting for im_convert_path or im_identify_path. |
| CVE-2020-12640 | CRITICAL | 9.8 | May 4, 2020 | Roundcube Webmail before 1.4.4 allows attackers to include local files and execute code via directory traversal in a plugin name to rcube_plugin_api.php. |
| CVE-2024-42009 | CRITICAL | 9.3 | Aug 5, 2024 | A Cross-Site Scripting vulnerability in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a crafted e-mail message that abuses a Desanitization issue in message_body() in program/actions/mail/show.php. |
| CVE-2024-42008 | CRITICAL | 9.3 | Aug 5, 2024 | A Cross-Site Scripting vulnerability in rcmail_action_mail_get->run() in Roundcube through 1.5.7 and 1.6.x through 1.6.7 allows a remote attacker to steal and send emails of a victim via a malicious e-mail attachment served with a dangerous Content-Type header. |
| CVE-2018-9846 | HIGH | 8.8 | Apr 7, 2018 | In Roundcube from versions 1.2.0 to 1.3.5, with the archive plugin enabled and configured, it's possible to exploit the unsanitized, user-controlled "_uid" parameter (in an archive.php _task=mail&_mbox=INBOX&_action=plugin.move2archive request) to perform an MX (IMAP) injection attack by placing an IMAP command after a %0d%0a sequence. NOTE: this is less easily exploitable in 1.3.4 and later because of a Same Origin Policy protection mechanism. |
| CVE-2017-16651 | HIGH | 7.8 | Nov 9, 2017 | Roundcube Webmail before 1.1.10, 1.2.x before 1.2.7, and 1.3.x before 1.3.3 allows unauthorized access to arbitrary files on the host's filesystem, including configuration files, as exploited in the wild in November 2017. The attacker must be able to authenticate at the target system with a valid username/password as the attack requires an active session. The issue is related to file-based attachment plugins and _task=settings&_action=upload-display&_from=timezone requests. |
| CVE-2018-19205 | HIGH | 7.5 | Nov 12, 2018 | Roundcube before 1.3.7 mishandles GnuPG MDC integrity-protection warnings, which makes it easier for attackers to obtain sensitive information, a related issue to CVE-2017-17688. This is associated with plugins/enigma/lib/enigma_driver_gnupg.php. |
| CVE-2018-1000071 | HIGH | 7.5 | Mar 13, 2018 | roundcube version 1.3.4 and earlier contains an Insecure Permissions vulnerability in enigma plugin that can result in exfiltration of gpg private key. This attack appear to be exploitable via network connectivity. |
| CVE-2019-15237 | HIGH | 7.4 | Aug 20, 2019 | Roundcube Webmail through 1.3.9 mishandles Punycode xn-- domain names, leading to homograph attacks. |
| CVE-2026-54433 | HIGH | 7.2 | Jul 14, 2026 | In Roundcube Webmail before 1.6.17 and 1.7.x before 1.7.2, there is Stored Cross-Site Scripting (XSS) via a crafted plain-text email message. The attacker-controlled JavaScript executes within the victim's authenticated session simply by opening or previewing the message (zero-click). |
| CVE-2025-68461 | HIGH | 7.2 | Dec 18, 2025 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a Cross-Site-Scripting (XSS) vulnerability via the animate tag in an SVG document. |
| CVE-2025-68460 | HIGH | 7.2 | Dec 18, 2025 | Roundcube Webmail before 1.5.12 and 1.6 before 1.6.12 is prone to a information disclosure vulnerability in the HTML style sanitizer. |
| CVE-2020-12626 | MEDIUM | 6.5 | May 4, 2020 | An issue was discovered in Roundcube Webmail before 1.4.4. A CSRF attack can cause an authenticated user to be logged out because POST was not considered. |
| CVE-2026-35539 | MEDIUM | 6.1 | Apr 3, 2026 | An issue was discovered in Roundcube Webmail before 1.5.14 and 1.6.14. XSS exists because of insufficient HTML attachment sanitization in preview mode. A victim must preview a text/html attachment. |
| CVE-2024-37384 | MEDIUM | 6.1 | Jun 7, 2024 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via list columns from user preferences. |
| CVE-2024-37383 | MEDIUM | 6.1 | Jun 7, 2024 | Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 allows XSS via SVG animate attributes. |
| CVE-2023-5631 | MEDIUM | 6.1 | Oct 18, 2023 | Roundcube before 1.4.15, 1.5.x before 1.5.5, and 1.6.x before 1.6.4 allows stored XSS via an HTML e-mail message with a crafted SVG document because of program/lib/Roundcube/rcube_washtml.php behavior. This could allow a remote attacker to load arbitrary JavaScript code. |
Showing the 20 most severe of 41 known CVEs.
Get Third Party Support