## Release 1.7.5

- Installer: Add possibility to detsroy the installer session/cookie
- Enigma: Fix db_sync() never restoring keyring files (#10343)
- Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
- Password: Replace SQL query placeholders in a single pass (#10345)
- Fix exit code of the healthcheck.sh script (#10337)
- Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action
- Security: Fix bug where an alias login wasn't qualified by IMAP host
- Security: Add a size limit to the CSS proxy content processing
- Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
- Security: Fix remote content blocking bypass via SVG SMIL `by` attribute
- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
- Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
- Security: Fix mail header injection via the From display-name in the Bounce (resend) action
- Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
- Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
- Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
- Security: Fix CSS scoping bypass in HTML messages using at-rules
- Security: Fix bug where deprecated action aliases bypassed `disabled_actions` setting
- Security: Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action
- Security: Fix CSRF validation bypass in the mark-as-junk action
- Security: Fix XSS issue in handling of password driver error responses
- Security: Fix mail header injection via subject of a message forwarded as attachment
- Security: Fix mail header injection via media type in an inline image data URI
- Security: Fix bug where Password Modoboa driver could change password for another account
- Security: Fix unsafe use of a login name in SquirrelMail import file path

## Release 1.7.4

- Use `X-Content-Type-Options:nosniff` for attachment previews and downloads (#10308)
- zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
- Security: Fix CSS declaration smuggling via un-encoded ampersand emission
- Security: Fix CSS property injection via body `background` attribute
- Security: Fix email header injection via bare CR in the subject field
- Security: Fix email header injection via C-escape \r in the recipient display name
- Security: Fix email header injection via identity's organization field
- Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
- Security: Fix XSS in the HTML editor using text/enriched part content
- Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
- Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
- Security: Fix remote-content blocker bypass via SVG SMIL src animation
- Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

## Release 1.7.3

- OAuth: Don't log an error when a refreshed token's TTL is below refresh_interval (#10213)
- Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
- Fix bug where searching in example_addressbook plugin was reporting zero results despite matches (#9022)
- Fix vCard import mis-detecting folded continuation lines as BEGIN/END:VCARD (#9593)
- Fix bug where the php session driver practically disabled session.lazy_write optimization (#9885, #10248)
- Fix bug where dates could get displayed shifted back one day in some places (#9403)
- Fix regression where it wasn't possible to hide a skin logo image anymore (#10254)
- Fix decoding of multi-segment RFC2231 extended attachment filenames (#10268)
- Fix vCard import silently dropping properties with a non-item group prefix (#10271)
- Fix so `REQUEST_URI` is used as a fallback if `PATH_INFO` is empty in static.php (#10181)
- Security: Add basic validation for content proxied by the css proxy [CVE-2026-74998]
- Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets [CVE-2026-75006]
- Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check [CVE-2026-75006]
- Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute [CVE-2026-75003]
- Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter` [CVE-2026-75007]
- Security: Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions` [CVE-2026-75004]
- Security: Fix RCE via `cmd_learn` driver of markasjunk plugin [CVE-2026-74997]
- Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization [CVE-2026-75002]
- Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host [CVE-2026-75010]
- Security: Fix stored XSS in "Add to address book" action [CVE-2026-74999]
- Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute [CVE-2026-75000]

## Release 1.7.2

- Add HEAD request handler to the `static.php`
- Fix so the `oauth_password_claim` claim is retrieved via token or userinfo request (#9631)
- Fix bug where `static.php` would return a 416 error on a specific `Range` request (#10194)
- Fix bug where configured skin logo wasn't loaded via `static.php` resulting in 404 error (#10191)
- Fix bug where installto.sh would fail if public_html folder does not exist in the target directory (#10202)
- Revert "Prefer 8bit over quoted-printable for HTML parts, when force_7bit is disabled (#8477)" (#10198)
- Fix incorrect unfolding of folded lines when importing vCard 2.1 contacts (#9647)
- Fix bug where Imagick could leave large temporary files on failure (#10230)
- Fix bug where redis/memcache session could have been updated more often than needed
- Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)
- Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) [CVE-2026-62642]
- Security: Fix various vulnerabilities in the password plugin using session-injected username [CVE-2026-62644]
- Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
- Security: Fix SSRF bypass via specific local address URLs - two new cases [CVE-2026-62643]
- Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
- Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file [CVE-2026-62641]

## Release 1.7.1

- Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
- Managesieve: Fix error when a mail message contains duplicate List-Id header (#10186)
- Clarified Elastic installation instructions (#10163)
- Added HTMLFormElement.requestSubmit() polyfill for older browsers (#10179)
- Fix so "has:attachment" search uses $HasAttachment/$HasNoAttachment keywords (#10168)
- Fix potential too long value in IMAP ID command (#10136)
- Fix redis/memcache disconnection in rcube::sleep() (#10127)
- Fix so static resources, e.g. skin_logo can be put inside the public_html directory (#10160)
- Fix so `REQUEST_URI` is used as a fallback if `PATH_INFO` is not set in static.php (#10181)
- Fix `assets_path` feature and remove dependency on `PATH_INFO` (#10185)
- Fix MySQL upgrade on MySQL < 8.0 and MariaDB < 10.5.3 (#10188)
- Security: Fix stored XSS/HTML/CSS injection in subject field of the draft restore dialog [CVE-2026-48849]
- Security: Fix CSS injection bypass in HTML sanitizer via SVG `<animate attributeName="style">` [CVE-2026-48848]
- Security: Fix pre-auth SQL injection in `virtuser_query` plugin via preg_replace backslash escape bypass [CVE-2026-48842]
- Security: Fix SSRF bypass via specific local address URLs [CVE-2026-48843]
- Security: Fix bypass of remote image blocking via CSS var() [CVE-2026-48846]
- Security: Fix local/private URL fetch bypass when remote resources were not allowed [CVE-2026-48845]
- Security: Fix pre-auth arbitrary file delete via redis/memcache session poisoning bypass [CVE-2026-48847]
- Security: Fix code injection vulnerability - remove support for code evaluation in LDAP `autovalues` option [CVE-2026-48844]