## Release 1.7.6

- Enable PHP 8.6 support (#10368, #10362)
- LDAP: Fix TypeError on group members listing with PHP 8 (#10364)
- Fix/Improve handling of IMAP literal strings
- Fix fatal error when a SORT/THREAD/SEARCH/ESEARCH command response includes untagged responses (#10361)
- Fix TypeError when archiving all messages via select-all (#10107)
- Fix temporary files permissions to 0600 (#10328)
- Fix refresh interval setting showing "never" when the configured value is not one of the predefined intervals (#10292)
- Fix installto.sh and update.sh reporting success when an upgrade step fails (#10326)
- Newmail_notifier: Fix restoring skin favicons defined with rel="icon" (#9575)
- LDAP: Fix website link including the labeledURI label (#8816)
- Fix non-ASCII special folder names displayed in UTF7-IMAP encoding when real names are shown (#10375)
- Security: Fix open redirect via IMAP error recovery on attachment get
- Security: Fix so Received: header includes only trusted hostname and forwarded IP from a trusted proxy
- Security: Fix bug where some managesieve destructive actions could have been triggered cross-site via GET
- Security: Fix Sieve script injection via a rule operator
- Security: Fix Sieve script injection via set/include modifiers
- Security: Fix bug where resolve_url() ignored trusted host setting
- Security: Fix mail header injection via a MDN subject
- Security: Fix HTTP request injection via the spellcheck ATD backend
- Security: Fix IMAP command injection via CRLF in _uid parameter with messages_cache enabled
- Security: Fix SSRF in CSS proxy via incomplete is_local_url() nip.io/sslip.io bypass
- Security: Fix CSRF validation bypass for file-only POST requests
- Security: Fix `disabled_actions` restriction bypass by writing '_' instead of '-' in the action name
- Security: Fix CSRF validation bypass for mail purge/expunge commands
- Security: Fix passing potentally unsafe attachment content into ImageMagick on image type conversion
- Security: Fix Unbounded CPU loop/DoS in rcube_session::unserialize() via a negative length token
- Security: Fix SSRF filter (is_local_url()) bypass via 6to4 (2002::/16) addresses
- Security: Fix so IMAP host input is validated more strictly

## Release 1.7.5

- Installer: Add possibility to detsroy the installer session/cookie
- Enigma: Fix db_sync() never restoring keyring files (#10343)
- Markasjunk: Skip messages whose %s/%h values start with '-' (#10344)
- Password: Replace SQL query placeholders in a single pass (#10345)
- Fix exit code of the healthcheck.sh script (#10337)
- Security: Fix IMAP command injection via CRLF in `_uid` parameter of mail/headers and mail/viewsource action
- Security: Fix bug where an alias login wasn't qualified by IMAP host
- Security: Add a size limit to the CSS proxy content processing
- Security: Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96
- Security: Fix remote content blocking bypass via SVG SMIL `by` attribute
- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again)
- Security: Fix passing potentally unsafe attachment content into ImageMagick on image resize
- Security: Fix mail header injection via the From display-name in the Bounce (resend) action
- Security: Fix mail header injection via References/In-Reply-To/Message-ID/From parameters
- Security: Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys
- Security: Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation
- Security: Fix CSS scoping bypass in HTML messages using at-rules
- Security: Fix bug where deprecated action aliases bypassed `disabled_actions` setting
- Security: Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action
- Security: Fix CSRF validation bypass in the mark-as-junk action
- Security: Fix XSS issue in handling of password driver error responses
- Security: Fix mail header injection via subject of a message forwarded as attachment
- Security: Fix mail header injection via media type in an inline image data URI
- Security: Fix bug where Password Modoboa driver could change password for another account
- Security: Fix unsafe use of a login name in SquirrelMail import file path

## Release 1.7.4

- Use `X-Content-Type-Options:nosniff` for attachment previews and downloads (#10308)
- zipdownload: Fix attachment filename sanitisation of backslash and control characters (#10325)
- Security: Fix CSS declaration smuggling via un-encoded ampersand emission
- Security: Fix CSS property injection via body `background` attribute
- Security: Fix email header injection via bare CR in the subject field
- Security: Fix email header injection via C-escape \r in the recipient display name
- Security: Fix email header injection via identity's organization field
- Security: Fix zero-click stored XSS via TNEF MIME tag injection in the attachment URL
- Security: Fix XSS in the HTML editor using text/enriched part content
- Security: Fix cross-user access in contact group membership (add/remove) in the SQL address book
- Security: Fix is_local_url() bypass via trailing-dot FQDN in stylesheet URL
- Security: Fix remote content blocking bypass via CSS escapes in FuncIRI attributes
- Security: Fix remote-content blocker bypass via SVG SMIL src animation
- Security: Fix SSRF bypass in Roundcube CSS proxy via hexadecimal IPv6-mapped IPv4 addresses

## Release 1.7.3

- OAuth: Don't log an error when a refreshed token's TTL is below refresh_interval (#10213)
- Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
- Fix bug where searching in example_addressbook plugin was reporting zero results despite matches (#9022)
- Fix vCard import mis-detecting folded continuation lines as BEGIN/END:VCARD (#9593)
- Fix bug where the php session driver practically disabled session.lazy_write optimization (#9885, #10248)
- Fix bug where dates could get displayed shifted back one day in some places (#9403)
- Fix regression where it wasn't possible to hide a skin logo image anymore (#10254)
- Fix decoding of multi-segment RFC2231 extended attachment filenames (#10268)
- Fix vCard import silently dropping properties with a non-item group prefix (#10271)
- Fix so `REQUEST_URI` is used as a fallback if `PATH_INFO` is empty in static.php (#10181)
- Security: Add basic validation for content proxied by the css proxy [CVE-2026-74998]
- Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets [CVE-2026-75006]
- Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check [CVE-2026-75006]
- Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute [CVE-2026-75003]
- Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter` [CVE-2026-75007]
- Security: Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions` [CVE-2026-75004]
- Security: Fix RCE via `cmd_learn` driver of markasjunk plugin [CVE-2026-74997]
- Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization [CVE-2026-75002]
- Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host [CVE-2026-75010]
- Security: Fix stored XSS in "Add to address book" action [CVE-2026-74999]
- Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute [CVE-2026-75000]

## Release 1.7.2

- Add HEAD request handler to the `static.php`
- Fix so the `oauth_password_claim` claim is retrieved via token or userinfo request (#9631)
- Fix bug where `static.php` would return a 416 error on a specific `Range` request (#10194)
- Fix bug where configured skin logo wasn't loaded via `static.php` resulting in 404 error (#10191)
- Fix bug where installto.sh would fail if public_html folder does not exist in the target directory (#10202)
- Revert "Prefer 8bit over quoted-printable for HTML parts, when force_7bit is disabled (#8477)" (#10198)
- Fix incorrect unfolding of folded lines when importing vCard 2.1 contacts (#9647)
- Fix bug where Imagick could leave large temporary files on failure (#10230)
- Fix bug where redis/memcache session could have been updated more often than needed
- Fix support for untyped tokens in OIDC backchannel logout, require unset `nonce` (#10097)
- Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193) [CVE-2026-62642]
- Security: Fix various vulnerabilities in the password plugin using session-injected username [CVE-2026-62644]
- Security: Fix stored XSS via unescaped attachment MIME type on the attachment-validation warning page [CVE-2026-54432]
- Security: Fix SSRF bypass via specific local address URLs - two new cases [CVE-2026-62643]
- Security: Fix zero-click stored XSS in plain-text rendering [CVE-2026-54433]
- Security: Fix DoS via crafted compressed-RTF size in the TNEF (winmail.dat) file [CVE-2026-62641]