Roundcube Webmail Security Updates Patches Multiple Critical Vulnerabilities

Roundcube Webmail 1.6.14 fixes multiple critical vulnerabilities across the 1.6.x branch — most notably a pre-auth arbitrary-file-write via unsafe deserialization that can lead to unauthenticated remote code execution, plus SSRF, information disclosure, an account password-change bypass enabling takeovers, IMAP injection combined with CSRF bypass, and several client-side XSS and privacy bypass issues; administrators are urged to back up systems and update immediately, with packages and signatures available on the project’s GitHub.