Version in base suite: 1.6.16+dfsg-0+deb13u1
Version in overlay suite: 1.6.17+dfsg-0+deb13u1

Base version: roundcube_1.6.17+dfsg-0+deb13u1
Target version: roundcube_1.6.18+dfsg-0+deb13u1
Base file: /srv/ftp-master.debian.org/ftp/pool/main/r/roundcube/roundcube_1.6.17+dfsg-0+deb13u1.dsc
Target file: /srv/ftp-master.debian.org/policy/pool/main/r/roundcube/roundcube_1.6.18+dfsg-0+deb13u1.dsc

 CHANGELOG.md                                                                   |   16 ++
 debian/changelog                                                               |   29 +++
 debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch            |   17 +-
 debian/patches/Fix-FTBFS-with-phpunit-11.patch                                 |   76 +++++-----
 debian/patches/Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch |   40 +++++
 debian/patches/series                                                          |    1 
 plugins/managesieve/lib/Roundcube/rcube_sieve_script.php                       |    2 
 plugins/markasjunk/drivers/cmd_learn.php                                       |   24 +--
 plugins/password/config.inc.php.dist                                           |   11 +
 plugins/password/drivers/modoboa.php                                           |   22 +-
 plugins/password/drivers/zxcvbn.php                                            |    2 
 program/actions/mail/addcontact.php                                            |    2 
 program/actions/mail/search.php                                                |    2 
 program/actions/utils/modcss.php                                               |   18 ++
 program/lib/Roundcube/rcube_ldap.php                                           |    5 
 program/lib/Roundcube/rcube_tnef_decoder.php                                   |   20 ++
 program/lib/Roundcube/rcube_utils.php                                          |   11 +
 program/lib/Roundcube/rcube_washtml.php                                        |    4 
 public_html/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php           |    2 
 public_html/plugins/markasjunk/drivers/cmd_learn.php                           |   24 +--
 public_html/plugins/password/config.inc.php.dist                               |   11 +
 public_html/plugins/password/drivers/modoboa.php                               |   22 +-
 public_html/plugins/password/drivers/zxcvbn.php                                |    2 
 tests/Framework/TnefDecoder.php                                                |   36 ++++
 tests/Framework/Utils.php                                                      |    8 +
 tests/Framework/Washtml.php                                                    |    8 +
 26 files changed, 317 insertions(+), 98 deletions(-)

dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp037pr1ph/roundcube_1.6.17+dfsg-0+deb13u1.dsc: no acceptable signature found
dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmp037pr1ph/roundcube_1.6.18+dfsg-0+deb13u1.dsc: no acceptable signature found
diff -Nru roundcube-1.6.17+dfsg/CHANGELOG.md roundcube-1.6.18+dfsg/CHANGELOG.md
--- roundcube-1.6.17+dfsg/CHANGELOG.md	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/CHANGELOG.md	2026-08-09 07:48:13.000000000 +0000
@@ -2,6 +2,22 @@
 
 ## Unreleased
 
+- Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
+- Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
+- Security: Add basic validation for content proxied by the css proxy
+- Security: Fix SSRF bypass via specific local address URLs using 100.64.0.0/10 and fe80::/10 nets
+- Security: Fix SSRF filter bypass via various forms of nip.io/sslip.io hostnames evading is_local_url() check
+- Security: Fix remote content blocking bypass via unclosed url() in a FuncIRI attribute
+- Security: Fix LDAP filter injection via unescaped %u/%fu/%d substitution into the `search_filter`
+- Security: Fix arbitrary Sieve script injection via a filter rule name bypassing `managesieve_disabled_actions`
+- Security: Fix RCE via `cmd_learn` driver of markasjunk plugin
+- Security: Fix IMAP command injection via mail search and LITERAL+ byte-count desynchronization
+- Security: Fix password's modoboa driver leak of an authentication token to a user-controlled host
+- Security: Fix stored XSS in "Add to address book" action
+- Security: Fix HTML/CSS sanitization bypass via SVG animate `by` attribute
+
+## Release 1.6.17
+
 - Enigma: Support automatic public key lookup (import) using HKP v1 protocol (#5314)
 - Enigma: Kolab WOAT Support (#8626)
 - Security: Fix an infinite loop in TNEF (winmail.dat) decoder (#10193)
diff -Nru roundcube-1.6.17+dfsg/debian/changelog roundcube-1.6.18+dfsg/debian/changelog
--- roundcube-1.6.17+dfsg/debian/changelog	2026-07-08 10:46:28.000000000 +0000
+++ roundcube-1.6.18+dfsg/debian/changelog	2026-08-10 13:45:10.000000000 +0000
@@ -1,3 +1,32 @@
+roundcube (1.6.18+dfsg-0+deb13u1) trixie-security; urgency=high
+
+  * New upstream security and bugfix release (closes: #1144059).
+    + Fix CVE-2026-74998: Content proxied by the css proxy is not validated
+      validation.
+    + Fix CVE-2026-75006: SSRF bypass via specific local address URLs using
+      100.64.0.0/10 and fe80::/10 subnets.
+    + Fix CVE-2026-75006: SSRF filter bypass via various forms of
+      nip.io/sslip.io hostnames evading `is_local_url()` check.
+    + Fix CVE-2026-75003: Remote content blocking bypass via unclosed `url()`
+      in a FuncIRI attribute.
+    + Fix CVE-2026-75007: LDAP filter injection via unescaped %u/%fu/%d
+      substitution into the `search_filter`.
+    + Fix CVE-2026-75004: Arbitrary sieve script injection via a filter rule
+      name bypassing `managesieve_disabled_actions`.
+    + Fix CVE-2026-74997: RCE in the `cmd_learn` driver of markasjunk plugin.
+    + Fix CVE-2026-75002: IMAP command injection via mail search and LITERAL+
+      byte-count desynchronization.
+    + Fix CVE-2026-75010: The modoboa driver of the passwd plugin leaks an
+      authentication token to a user-controlled host.
+    + Fix CVE-2026-74999: Stored XSS in "Add to address book" action.
+    + Fix CVE-2026-75000: HTML/CSS sanitization bypass via SVG animate `by`
+      attribute.
+  * Refresh d/patches.
+  * Cherry-pick follow-up change to fix PHP warning in markasjunk's
+    cmd_learn.php.
+
+ -- Guilhem Moulin <guilhem@debian.org>  Mon, 10 Aug 2026 15:45:10 +0200
+
 roundcube (1.6.17+dfsg-0+deb13u1) trixie-security; urgency=high
 
   * New upstream security and bugfix release (closes: #1141495).
diff -Nru roundcube-1.6.17+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch roundcube-1.6.18+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch
--- roundcube-1.6.17+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch	2026-07-08 10:46:28.000000000 +0000
+++ roundcube-1.6.18+dfsg/debian/patches/Avoid-dependency-on-new-package-mlocati-ip-lib.patch	2026-08-10 13:45:10.000000000 +0000
@@ -11,9 +11,9 @@
 Forwarded: not-needed
 ---
  composer.json-dist                    |   3 +-
- program/lib/Roundcube/rcube_utils.php | 160 +++++++++++++++++++++++++++++-----
+ program/lib/Roundcube/rcube_utils.php | 164 +++++++++++++++++++++++++++++-----
  tests/Framework/Utils.php             |  85 ++++++++++++++++++
- 3 files changed, 224 insertions(+), 24 deletions(-)
+ 3 files changed, 226 insertions(+), 26 deletions(-)
 
 diff --git a/composer.json-dist b/composer.json-dist
 index 1807004..ca3de26 100644
@@ -30,7 +30,7 @@
      "require-dev": {
          "phpunit/phpunit": "^9"
 diff --git a/program/lib/Roundcube/rcube_utils.php b/program/lib/Roundcube/rcube_utils.php
-index 8a3d1e9..6c3d04a 100644
+index 673ce69..0c2e293 100644
 --- a/program/lib/Roundcube/rcube_utils.php
 +++ b/program/lib/Roundcube/rcube_utils.php
 @@ -1,8 +1,5 @@
@@ -159,7 +159,7 @@
      /**
       * Check if an URL point to a local network location.
       *
-@@ -434,37 +541,46 @@ class rcube_utils
+@@ -434,14 +541,9 @@ class rcube_utils
          $host = parse_url($url, \PHP_URL_HOST);
  
          if (is_string($host)) {
@@ -175,7 +175,8 @@
              $host = preg_replace('/^[0:]*:ffff:/i', '', $host);
  
              if (preg_match('/([0-9a-f.-]+)\.(nip|sslip)\.io$/i', $host, $matches)) {
-                 $host = trim($matches[1], '-.');
+@@ -455,25 +557,39 @@ class rcube_utils
+                 }
              }
  
 +            if (strpos($host, ':') !== false && ($n = strpos($host, '%')) > 0) {
@@ -193,8 +194,10 @@
 -                    '172.16.0.0/12',  // RFC1918
 -                    '192.168.0.0/16', // RFC1918
 -                    '169.254.0.0/16', // link-local / cloud metadata
+-                    '100.64.0.0/10',  // RFC6598: Shared Address Space (carrier-grade NAT)
 -                    '::1/128',
 -                    'fc00::/7',
+-                    'fe80::/10',      // IPv6 link-local
 +            if (is_string($address = \rcube_utils::inet_pton2($host))) {
 +                 $nets = [
 +                    ['0.0.0.0',     '0.0.0.0'],
@@ -203,6 +206,7 @@
 +                    ['172.16.0.0',  '172.31.255.255'],  // RFC1918
 +                    ['192.168.0.0', '192.168.255.255'], // RFC1918
 +                    ['169.254.0.0', '169.254.255.255'], // link-local / cloud metadata
++                    ['100.64.0.0',  '100.127.255.255'], // RFC6598: Shared Address Space (carrier-grade NAT)
                  ];
 +                if (defined('AF_INET6')) {
 +                    /* IPv4-compatible and IPv4-mapped IPv6 addresses (RFC4291 2.5.5) */
@@ -213,6 +217,7 @@
 +                    }
 +                    $nets[] = ['::1',    '::1'];
 +                    $nets[] = ['fc00::', 'fdff:ffff:ffff:ffff:ffff:ffff:ffff:ffff'];
++                    $nets[] = ['fe80::', 'febf:ffff:ffff:ffff:ffff:ffff:ffff:ffff'];
 +                }
  
 -                foreach ($nets as $net) {
@@ -226,7 +231,7 @@
                      }
                  }
 diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
-index 90d8e03..9ad6989 100644
+index 4b8e584..8c69f72 100644
 --- a/tests/Framework/Utils.php
 +++ b/tests/Framework/Utils.php
 @@ -571,6 +571,86 @@ class Framework_Utils extends TestCase
diff -Nru roundcube-1.6.17+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch roundcube-1.6.18+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch
--- roundcube-1.6.17+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch	2026-07-08 10:46:28.000000000 +0000
+++ roundcube-1.6.18+dfsg/debian/patches/Fix-FTBFS-with-phpunit-11.patch	2026-08-10 13:45:10.000000000 +0000
@@ -9829,7 +9829,7 @@
  
          $this->assertEquals($expected, $html);
 diff --git a/tests/Framework/TnefDecoder.php b/tests/Framework/TnefDecoder.php
-index f895172..ec5b244 100644
+index 8fb9632..6fec023 100644
 --- a/tests/Framework/TnefDecoder.php
 +++ b/tests/Framework/TnefDecoder.php
 @@ -1,11 +1,13 @@
@@ -9876,7 +9876,7 @@
          $result = $tnef->decompress($body, true);
  
          $this->assertCount(0, $result['attachments']);
-@@ -84,7 +86,7 @@ class Framework_TnefDecoder extends PHPUnit\Framework\TestCase
+@@ -120,7 +122,7 @@ class Framework_TnefDecoder extends PHPUnit\Framework\TestCase
      function test_rtf2text()
      {
          $body = file_get_contents(TESTS_DIR . 'src/sample.rtf');
@@ -9996,7 +9996,7 @@
          $idents = $user->list_identities();
  
 diff --git a/tests/Framework/Utils.php b/tests/Framework/Utils.php
-index 8ac3a92..90d8e03 100644
+index 4cec5ab..4b8e584 100644
 --- a/tests/Framework/Utils.php
 +++ b/tests/Framework/Utils.php
 @@ -1,11 +1,15 @@
@@ -10371,7 +10371,7 @@
              $this->assertSame($v[2], $result);
          }
      }
-@@ -633,7 +643,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -641,7 +651,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $datetime => $ts) {
@@ -10380,7 +10380,7 @@
              $this->assertSame($ts, $result, "Error parsing date: $datetime");
          }
      }
-@@ -660,7 +670,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -668,7 +678,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $datetime => $ts) {
@@ -10389,7 +10389,7 @@
              $this->assertSame($ts, $result ? $result->format('Y-m-d') : false, "Error parsing date: $datetime");
          }
  
-@@ -670,7 +680,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -678,7 +688,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $datetime => $ts) {
@@ -10398,7 +10398,7 @@
              $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s') : false, "Error parsing date: $datetime");
          }
  
-@@ -679,7 +689,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -687,7 +697,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $datetime => $ts) {
@@ -10407,7 +10407,7 @@
              $this->assertSame($ts, $result ? $result->format('Y-m-d H:i:s O') : false, "Error parsing date: $datetime");
          }
      }
-@@ -689,17 +699,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -697,17 +707,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       */
      function test_anytodatetime_timezone()
      {
@@ -10428,7 +10428,7 @@
              if ($result) $result->setTimezone($tz);  // move to target timezone for comparison
              $this->assertSame($ts, $result ? $result->format('Y-m-d H:i') : false, "Error parsing date: $datetime");
          }
-@@ -718,7 +728,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -726,7 +736,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $data) {
@@ -10437,7 +10437,7 @@
              $this->assertSame($data[2], $result, "Error formatting date: " . $data[0]);
          }
      }
-@@ -737,7 +747,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -745,7 +755,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $input => $output) {
@@ -10446,7 +10446,7 @@
              $this->assertSame($output, $result);
          }
      }
-@@ -762,7 +772,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -770,7 +780,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $input => $output) {
@@ -10455,7 +10455,7 @@
              $this->assertSame($output, $result, "Error normalizing '$input'");
          }
      }
-@@ -785,7 +795,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -793,7 +803,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($test as $idx => $params) {
@@ -10464,7 +10464,7 @@
              $this->assertSame($params[2], $result, "words_match() at index $idx");
          }
      }
-@@ -811,7 +821,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -819,7 +829,7 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
          }
  
          foreach ($test as $input => $output) {
@@ -10473,7 +10473,7 @@
              $this->assertSame($output, $result);
          }
      }
-@@ -821,17 +831,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -829,17 +839,17 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       */
      function test_random_bytes()
      {
@@ -10497,7 +10497,7 @@
      {
  
          /*
-@@ -868,9 +878,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -876,9 +886,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       * @param string $encoded Encoded email address
       * @dataProvider data_idn_convert
       */
@@ -10509,7 +10509,7 @@
      }
  
      /**
-@@ -880,9 +891,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -888,9 +899,10 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       * @param string $encoded Encoded email address
       * @dataProvider data_idn_convert
       */
@@ -10521,7 +10521,7 @@
      }
  
      /**
-@@ -890,14 +902,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -898,14 +910,14 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       */
      function test_idn_to_ascii_special()
      {
@@ -10539,7 +10539,7 @@
      {
          return [
              ['%z', 'hostname', 'hostname'],
-@@ -912,15 +924,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -920,15 +932,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       *
       * @dataProvider data_parse_host
       */
@@ -10558,7 +10558,7 @@
      {
          return [
              [['hostname', null, null], ['hostname', null, null]],
-@@ -943,15 +956,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -951,15 +964,16 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       *
       * @dataProvider data_parse_host_uri
       */
@@ -10577,7 +10577,7 @@
          return [
              ['both',    'Fwd: Re: Test subject both', 'Test subject both'],
              ['both',    'Re: Fwd: Test subject both', 'Test subject both'],
-@@ -969,8 +983,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -977,8 +991,9 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       * 
       * @dataProvider data_remove_subject_prefix
       */
@@ -10588,7 +10588,7 @@
      }
  
      /**
-@@ -978,13 +993,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -986,13 +1001,13 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
       */
      function test_server_name()
      {
@@ -10605,7 +10605,7 @@
      }
  
      /**
-@@ -994,31 +1009,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
+@@ -1002,31 +1017,31 @@ class Framework_Utils extends PHPUnit\Framework\TestCase
      {
          $_SERVER['test'] = 'test.com';
  
@@ -10804,7 +10804,7 @@
  
          $this->assertSame($result, "BEGIN:VCARD\r\nVERSION:3.0\r\nFN:\r\nN:;;;;\r\nEND:VCARD");
 diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php
-index 7d524f4..770ef3a 100644
+index 6b2d026..90b680e 100644
 --- a/tests/Framework/Washtml.php
 +++ b/tests/Framework/Washtml.php
 @@ -1,11 +1,14 @@
@@ -11005,7 +11005,7 @@
      {
          $svg1 = "<svg id='x' width='100' height='100'><a xlink:href='javascript:alert(1)'><rect x='0' y='0' width='100' height='100' /></a></svg>";
  
-@@ -545,9 +548,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -553,9 +556,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
       *
       * @dataProvider data_wash_svg_tests
       */
@@ -11017,7 +11017,7 @@
          $washed = $washer->wash($input);
  
          $this->assertSame($expected, $this->cleanupResult($washed), "SVG content");
-@@ -556,7 +560,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -564,7 +568,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      /**
       * Test cases for various XSS issues
       */
@@ -11026,7 +11026,7 @@
      {
          return [
              [
-@@ -611,9 +615,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -619,9 +623,10 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
       *
       * @dataProvider data_wash_xss_tests
       */
@@ -11038,7 +11038,7 @@
          $washed = $washer->wash($input);
  
          $this->assertSame($expected, $this->cleanupResult($washed), "XSS issues");
-@@ -627,7 +632,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -635,7 +640,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
          $html = "<img style='position:fixed' /><img style=\"position:/**/ fixed; top:10px\" />";
          $exp  = "<img style=\"position: absolute\" /><img style=\"position: absolute; top: 10px\" />";
  
@@ -11047,7 +11047,7 @@
          $washed = $washer->wash($html);
  
          $this->assertTrue(strpos($washed, $exp) !== false, "Position:fixed (#5264)");
-@@ -671,7 +676,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -679,7 +684,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
                  <annotation encoding="TeX">I_D = \frac{1}{2} k_n \frac{W}{L} (V_{GS}-V_t)^2</annotation>
              </semantics></math>';
  
@@ -11056,7 +11056,7 @@
          $washed = $washer->wash($mathml);
  
          // remove whitespace between tags
-@@ -688,7 +693,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -696,7 +701,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      {
          $html = "<input type=\"image\" src=\"http://TRACKING_URL/\">";
  
@@ -11065,7 +11065,7 @@
          $washed = $washer->wash($html);
  
          $this->assertTrue($washer->extlinks);
-@@ -696,7 +701,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -704,7 +709,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
  
          $html = "<video src=\"http://TRACKING_URL/\">";
  
@@ -11074,7 +11074,7 @@
          $washed = $washer->wash($html);
  
          $this->assertTrue($washer->extlinks);
-@@ -724,14 +729,14 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -732,14 +737,14 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
          ];
  
          foreach ($html as $item) {
@@ -11091,7 +11091,7 @@
              $washed = $washer->wash($item[0]);
  
              $this->assertFalse($washer->extlinks);
-@@ -742,7 +747,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -750,7 +755,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      {
          $html = '<textarea><p style="x:</textarea><img src=x onerror=alert(1)>">';
  
@@ -11100,7 +11100,7 @@
          $washed = $washer->wash($html);
  
          $this->assertStringNotContainsString('onerror=alert(1)>', $washed);
-@@ -754,7 +759,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -762,7 +767,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
       */
      function test_css_prefix()
      {
@@ -11109,7 +11109,7 @@
  
          $html   = '<p id="my-id">'
              . '<label for="my-other-id" class="my-class1 my-class2">test</label>'
-@@ -782,14 +787,14 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -790,14 +795,14 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      {
          $html = '<p><?xml:namespace prefix = "xsl" /></p>';
  
@@ -11126,7 +11126,7 @@
          $washed = $this->cleanupResult($washer->wash($html));
  
          $this->assertSame($washed, 'HTML');
-@@ -800,7 +805,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -808,7 +813,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
       */
      function test_missing_tags()
      {
@@ -11135,7 +11135,7 @@
  
          $html   = '<head></head>First line<br />Second line';
          $washed = $washer->wash($html);
-@@ -842,7 +847,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -850,7 +855,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      {
          $html = '<p><![CDATA[<script>alert(document.cookie)</script>]]></p>';
  
@@ -11144,7 +11144,7 @@
          $washed = $washer->wash($html);
  
          $this->assertTrue(strpos($washed, '<script>') === false, "CDATA content");
-@@ -854,7 +859,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -862,7 +867,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
      function test_resolve_base()
      {
          $html = file_get_contents(TESTS_DIR . 'src/htmlbase.txt');
@@ -11153,7 +11153,7 @@
  
          $this->assertMatchesRegularExpression('|src="http://alec\.pl/dir/img1\.gif"|', $html, "URI base resolving [1]");
          $this->assertMatchesRegularExpression('|src="http://alec\.pl/dir/img2\.gif"|', $html, "URI base resolving [2]");
-@@ -900,7 +905,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
+@@ -908,7 +913,7 @@ class Framework_Washtml extends PHPUnit\Framework\TestCase
    <tr><td></td></tr>
  </table>';
  
diff -Nru roundcube-1.6.17+dfsg/debian/patches/Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch roundcube-1.6.18+dfsg/debian/patches/Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch
--- roundcube-1.6.17+dfsg/debian/patches/Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch	1970-01-01 00:00:00.000000000 +0000
+++ roundcube-1.6.18+dfsg/debian/patches/Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch	2026-08-10 13:45:10.000000000 +0000
@@ -0,0 +1,40 @@
+From: Aleksander Machniak <alec@alec.pl>
+Date: Mon, 10 Aug 2026 10:07:36 +0200
+Subject: Fix PHP Warning: Undefined variable $tmp_command in
+ .../plugins/markasjunk/drivers/cmd_learn.php
+
+Origin: https://github.com/roundcube/roundcubemail/commit/495d211638f222336b20f4744545c53712426c2a
+Bug: https://github.com/roundcube/roundcubemail/issues/10294
+---
+ CHANGELOG.md                             | 4 ++++
+ plugins/markasjunk/drivers/cmd_learn.php | 2 +-
+ 2 files changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/CHANGELOG.md b/CHANGELOG.md
+index b410719..9f7aba0 100644
+--- a/CHANGELOG.md
++++ b/CHANGELOG.md
+@@ -2,6 +2,10 @@
+ 
+ ## Unreleased
+ 
++- Fix PHP Warning: Undefined variable $tmp_command in .../plugins/markasjunk/drivers/cmd_learn.php (#10294)
++
++## Release 1.6.18
++
+ - Password: Fix fatal error "Class 'Zxcvbn' not found" (#10274)
+ - Fix out-of-bounds string reads on truncated compressed-RTF in the TNEF decoder (#10269)
+ - Security: Add basic validation for content proxied by the css proxy
+diff --git a/plugins/markasjunk/drivers/cmd_learn.php b/plugins/markasjunk/drivers/cmd_learn.php
+index 77b7b9b..7238375 100644
+--- a/plugins/markasjunk/drivers/cmd_learn.php
++++ b/plugins/markasjunk/drivers/cmd_learn.php
+@@ -71,7 +71,7 @@ class markasjunk_cmd_learn
+         foreach ($uids as $uid) {
+             $replace = $vars;
+ 
+-            if (strpos($tmp_command, '%s') !== false) {
++            if (strpos($command, '%s') !== false) {
+                 $message = new rcube_message($uid);
+                 $replace['%s'] = escapeshellarg($message->sender['mailto']);
+             }
diff -Nru roundcube-1.6.17+dfsg/debian/patches/series roundcube-1.6.18+dfsg/debian/patches/series
--- roundcube-1.6.17+dfsg/debian/patches/series	2026-07-08 10:46:28.000000000 +0000
+++ roundcube-1.6.18+dfsg/debian/patches/series	2026-08-10 13:45:10.000000000 +0000
@@ -20,4 +20,5 @@
 Free-enchant-dictionary-resources.patch
 Fix-FTBFS-with-phpunit-11.patch
 Fix-flaky-test.patch
+Fix-PHP-Warning-Undefined-variable-tmp_command-in-.-plugi.patch
 Avoid-dependency-on-new-package-mlocati-ip-lib.patch
diff -Nru roundcube-1.6.17+dfsg/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php roundcube-1.6.18+dfsg/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
--- roundcube-1.6.17+dfsg/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php	2026-08-09 07:48:13.000000000 +0000
@@ -240,7 +240,7 @@
 
             // header
             if (!empty($rule['name']) && strlen($rule['name'])) {
-                $script .= '# rule:[' . $rule['name'] . "]\r\n";
+                $script .= '# rule:[' . preg_replace('/[\r\n]+/', ' ', $rule['name']) . "]\r\n";
             }
 
             // constraints expressions
diff -Nru roundcube-1.6.17+dfsg/plugins/markasjunk/drivers/cmd_learn.php roundcube-1.6.18+dfsg/plugins/markasjunk/drivers/cmd_learn.php
--- roundcube-1.6.17+dfsg/plugins/markasjunk/drivers/cmd_learn.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/plugins/markasjunk/drivers/cmd_learn.php	2026-08-09 07:48:13.000000000 +0000
@@ -56,21 +56,24 @@
 
         // backwards compatibility %xds removed in markasjunk v1.12
         $command = str_replace('%xds', '%h:x-dspam-signature', $command);
-        $command = str_replace('%u', escapeshellarg($_SESSION['username']), $command);
-        $command = str_replace('%l', escapeshellarg($rcube->user->get_username('local')), $command);
-        $command = str_replace('%d', escapeshellarg($rcube->user->get_username('domain')), $command);
+
+        $vars = [
+            '%u' => escapeshellarg($rcube->get_user_name()),
+            '%l' => escapeshellarg($rcube->user->get_username('local')),
+            '%d' => escapeshellarg($rcube->user->get_username('domain')),
+        ];
+
         if (strpos($command, '%i') !== false) {
             $identity = $rcube->user->get_identity();
-            $command  = str_replace('%i', escapeshellarg($identity['email']), $command);
+            $vars['%i'] = escapeshellarg($identity['email']);
         }
 
         foreach ($uids as $uid) {
-            // reset command for next message
-            $tmp_command = $command;
+            $replace = $vars;
 
             if (strpos($tmp_command, '%s') !== false) {
-                $message     = new rcube_message($uid);
-                $tmp_command = str_replace('%s', escapeshellarg($message->sender['mailto']), $tmp_command);
+                $message = new rcube_message($uid);
+                $replace['%s'] = escapeshellarg($message->sender['mailto']);
             }
 
             if (!empty($header_names)) {
@@ -86,7 +89,7 @@
                     }
 
                     if (!empty($val)) {
-                        $tmp_command = str_replace('%h:' . $header, escapeshellarg($val), $tmp_command);
+                        $replace['%h:' . $header] = escapeshellarg($val);
                     }
                     else {
                         if ($debug) {
@@ -101,9 +104,10 @@
             if (strpos($command, '%f') !== false) {
                 $tmpfname = tempnam($temp_dir, 'rcmSALearn');
                 file_put_contents($tmpfname, $rcube->storage->get_raw_body($uid));
-                $tmp_command = str_replace('%f', escapeshellarg($tmpfname), $tmp_command);
+                $replace['%f'] = escapeshellarg($tmpfname);
             }
 
+            $tmp_command = strtr($command, $replace);
             $output = shell_exec($tmp_command);
 
             if ($debug) {
diff -Nru roundcube-1.6.17+dfsg/plugins/password/config.inc.php.dist roundcube-1.6.18+dfsg/plugins/password/config.inc.php.dist
--- roundcube-1.6.17+dfsg/plugins/password/config.inc.php.dist	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/plugins/password/config.inc.php.dist	2026-08-09 07:48:13.000000000 +0000
@@ -456,7 +456,16 @@
 
 // Modoboa Driver options
 // ---------------------
-// put token number from Modoboa server
+// API host. Supported replacement variables:
+// %h - user's IMAP hostname
+// %n - hostname ($_SERVER['SERVER_NAME'])
+// %t - hostname without the first part
+// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
+// %z - IMAP domain (IMAP hostname without the first part)
+// Note: For security reasons replacement variables are not available if $config['imap_host'] is empty.
+$config['password_modoboa_api_host'] = '%h';
+
+// Modoboa API authentication token
 $config['password_modoboa_api_token'] = '';
 
 
diff -Nru roundcube-1.6.17+dfsg/plugins/password/drivers/modoboa.php roundcube-1.6.18+dfsg/plugins/password/drivers/modoboa.php
--- roundcube-1.6.17+dfsg/plugins/password/drivers/modoboa.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/plugins/password/drivers/modoboa.php	2026-08-09 07:48:13.000000000 +0000
@@ -35,19 +35,23 @@
 
 class rcube_modoboa_password
 {
-    function save($curpass, $passwd)
+    function save($curpass, $passwd, $username)
     {
         // Init config access
-        $rcmail           = rcmail::get_instance();
-        $ModoboaToken     = $rcmail->config->get('password_modoboa_api_token');
-        $RoudCubeUsername = $_SESSION['username'];
-        $IMAPhost         = $_SESSION['imap_host'];
+        $rcmail = rcmail::get_instance();
+        $token = $rcmail->config->get('password_modoboa_api_token');
+        $host = $rcmail->config->get('password_modoboa_api_host');
+
+        // We don't allow replacement variables when the host name(s) come from the user
+        if (!empty($rcmail->config->get('imap_host'))) {
+            $host = rcube_utils::parse_host($host);
+        }
 
         // Call GET to fetch values from modoboa server
         $curl = curl_init();
 
         curl_setopt_array($curl, [
-            CURLOPT_URL            => "https://" . $IMAPhost . "/api/v1/accounts/?search=" . urlencode($RoudCubeUsername),
+            CURLOPT_URL            => "https://" . $host . "/api/v1/accounts/?search=" . urlencode($username),
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_ENCODING       => "",
             CURLOPT_MAXREDIRS      => 10,
@@ -55,7 +59,7 @@
             CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1,
             CURLOPT_CUSTOMREQUEST  => "GET",
             CURLOPT_HTTPHEADER     => [
-                "Authorization: Token " . $ModoboaToken,
+                "Authorization: Token " . $token,
                 "Cache-Control: no-cache",
                 "Content-Type: application/json"
             ],
@@ -91,7 +95,7 @@
         $curl = curl_init();
 
         curl_setopt_array($curl, [
-            CURLOPT_URL            => "https://" . $IMAPhost . "/api/v1/accounts/" . $userid . "/",
+            CURLOPT_URL            => "https://" . $host . "/api/v1/accounts/" . $userid . "/",
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_ENCODING       => "",
             CURLOPT_MAXREDIRS      => 10,
@@ -100,7 +104,7 @@
             CURLOPT_CUSTOMREQUEST  => "PUT",
             CURLOPT_POSTFIELDS     => "" . $encoded . "",
             CURLOPT_HTTPHEADER     => [
-                "Authorization: Token " . $ModoboaToken,
+                "Authorization: Token " . $token,
                 "Cache-Control: no-cache",
                 "Content-Type: application/json"
             ],
diff -Nru roundcube-1.6.17+dfsg/plugins/password/drivers/zxcvbn.php roundcube-1.6.18+dfsg/plugins/password/drivers/zxcvbn.php
--- roundcube-1.6.17+dfsg/plugins/password/drivers/zxcvbn.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/plugins/password/drivers/zxcvbn.php	2026-08-09 07:48:13.000000000 +0000
@@ -1,5 +1,7 @@
 <?php
 
+use ZxcvbnPhp\Zxcvbn;
+
 /**
  * Zxcvb Password Strength Driver
  *
diff -Nru roundcube-1.6.17+dfsg/program/actions/mail/addcontact.php roundcube-1.6.18+dfsg/program/actions/mail/addcontact.php
--- roundcube-1.6.17+dfsg/program/actions/mail/addcontact.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/actions/mail/addcontact.php	2026-08-09 07:48:13.000000000 +0000
@@ -90,7 +90,7 @@
             }
         }
         else {
-            $rcmail->output->show_message($error ?: 'errorsavingcontact', 'error', null, false);
+            $rcmail->output->show_message($error ? rcmail::Q($error) : 'errorsavingcontact', 'error', null, false);
         }
 
         $rcmail->output->send();
diff -Nru roundcube-1.6.17+dfsg/program/actions/mail/search.php roundcube-1.6.18+dfsg/program/actions/mail/search.php
--- roundcube-1.6.17+dfsg/program/actions/mail/search.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/actions/mail/search.php	2026-08-09 07:48:13.000000000 +0000
@@ -232,6 +232,8 @@
         $srch      = null;
         $supported = ['subject', 'from', 'to', 'cc', 'bcc'];
 
+        $str = preg_replace('/[\r\n]+/', ' ', $str);
+
         // Check the search string for type of search
         if (preg_match("/^(from|to|reply-to|cc|bcc|subject):.*/i", $str, $m)) {
             list(, $srch) = explode(":", $str);
diff -Nru roundcube-1.6.17+dfsg/program/actions/utils/modcss.php roundcube-1.6.18+dfsg/program/actions/utils/modcss.php
--- roundcube-1.6.17+dfsg/program/actions/utils/modcss.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/actions/utils/modcss.php	2026-08-09 07:48:13.000000000 +0000
@@ -65,9 +65,8 @@
 
         $container_id = preg_replace('/[^a-z0-9]/i', '', $cid);
         $css_prefix   = preg_replace('/[^a-z0-9]/i', '', $prefix);
-        $ctype_regexp = '~^text/(css|plain)~i';
 
-        if ($source !== false && $ctype && preg_match($ctype_regexp, $ctype)) {
+        if ($source !== false && self::is_valid_css($source, $ctype)) {
             $rcmail->output->sendExit(
                 rcube_utils::mod_css_styles($source, $container_id, false, $css_prefix),
                 ['Content-Type: text/css']
@@ -76,4 +75,19 @@
 
         $rcmail->output->sendExitError(404, "Invalid response returned by server");
     }
+
+    /**
+     * Do basic response validation
+     */
+    private static function is_valid_css(string $source, $ctype): bool
+    {
+        // Because we can't block all requests to local services we have to be strict
+        // on what we proxy to the browser. Here we check if we deal with css or not.
+
+        return preg_match('~^text/(css|plain)~i', (string) $ctype)
+            && !preg_match('~^[{<]~', $source) // exclude json and html
+            && strpos($source, '{')
+            && strpos($source, '}')
+            && strpos($source, ':');
+    }
 }
diff -Nru roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_ldap.php roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_ldap.php
--- roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_ldap.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_ldap.php	2026-08-09 07:48:13.000000000 +0000
@@ -349,11 +349,12 @@
 
                 // Get the pieces needed for variable replacement.
                 if ($fu = ($rcube->get_user_email() ?: ($conf['username'] ?? null))) {
+                    $fu = rcube_ldap_generic::quote_string($fu);
                     list($u, $d) = explode('@', $fu);
                 }
                 else {
                     $u = '';
-                    $d = $this->mail_domain;
+                    $d = rcube_ldap_generic::quote_string($this->mail_domain);
                 }
 
                 $dc = 'dc='.strtr($d, ['.' => ',dc=']); // hierarchal domain string
@@ -2216,7 +2217,7 @@
         }
 
         $base_dn     = $this->groups_base_dn;
-        $contact_dn  = self::dn_decode($contact_id);
+        $contact_dn  = rcube_ldap_generic::quote_string(self::dn_decode($contact_id));
         $name_attr   = $this->prop['groups']['name_attr'] ?: 'cn';
         $member_attr = $this->get_group_member_attr();
         $add_filter  = '';
diff -Nru roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_tnef_decoder.php roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_tnef_decoder.php
--- roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_tnef_decoder.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_tnef_decoder.php	2026-08-09 07:48:13.000000000 +0000
@@ -547,6 +547,12 @@
         }
 
         while ($out < ($size + $length_preload)) {
+            // Bail out if the input is exhausted to avoid out-of-bounds reads
+            // on truncated/malformed payloads.
+            if ($in >= $max_len) {
+                break;
+            }
+
             if (($flag_count++ % 8) == 0) {
                 $flags = ord($data[$in++]);
             }
@@ -555,6 +561,11 @@
             }
 
             if (($flags & 1) != 0) {
+                // The back-reference branch reads two more bytes.
+                if ($in + 1 >= $max_len) {
+                    break;
+                }
+
                 $offset = ord($data[$in++]);
                 $length = ord($data[$in++]);
                 $offset = ($offset << 4) | ($length >> 4);
@@ -573,13 +584,14 @@
                 }
             }
             else {
+                // The literal branch reads one more byte.
+                if ($in >= $max_len) {
+                    break;
+                }
+
                 $uncomp .= $data[$in++];
                 ++$out;
             }
-
-            if ($in >= $max_len) {
-                break;
-            }
         }
 
         return substr($uncomp, $length_preload);
diff -Nru roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_utils.php roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_utils.php
--- roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_utils.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_utils.php	2026-08-09 07:48:13.000000000 +0000
@@ -445,7 +445,14 @@
             $host = preg_replace('/^[0:]*:ffff:/i', '', $host);
 
             if (preg_match('/([0-9a-f.-]+)\.(nip|sslip)\.io$/i', $host, $matches)) {
-                $host = trim($matches[1], '-.');
+                $host = $matches[1];
+                if (preg_match('/([0-9]{1,3}([.-][0-9]{1,3}){3})$/', $host, $m)) {
+                    $host = str_replace('-', '.', $m[1]); // IPv4
+                } elseif (preg_match('/^([0-9a-f]{8})$/i', $host, $m)) {
+                    $host = long2ip(base_convert($m[1], 16, 10)); // Hexadecimal
+                } else {
+                    $host = str_replace('-', ':', $host); // IPv6
+                }
             }
 
             // TODO: This is pretty fast, but a single message can contain multiple links
@@ -458,8 +465,10 @@
                     '172.16.0.0/12',  // RFC1918
                     '192.168.0.0/16', // RFC1918
                     '169.254.0.0/16', // link-local / cloud metadata
+                    '100.64.0.0/10',  // RFC6598: Shared Address Space (carrier-grade NAT)
                     '::1/128',
                     'fc00::/7',
+                    'fe80::/10',      // IPv6 link-local
                 ];
 
                 foreach ($nets as $net) {
diff -Nru roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_washtml.php roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_washtml.php
--- roundcube-1.6.17+dfsg/program/lib/Roundcube/rcube_washtml.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/program/lib/Roundcube/rcube_washtml.php	2026-08-09 07:48:13.000000000 +0000
@@ -293,7 +293,7 @@
             $key   = strtolower($name);
             $value = $attr->nodeValue;
 
-            if ($key == 'style' || ($key == 'values' && self::attribute_value($node, 'attributename', '/^style$/i'))) {
+            if ($key == 'style' || (in_array($key, ['by', 'values']) && self::attribute_value($node, 'attributename', '/^style$/i'))) {
                 $style = '';
                 if ($value === '' || ($style = $this->wash_style($value))) {
                     // replace double quotes to prevent syntax error and XSS issues (#1490227)
@@ -324,7 +324,7 @@
                 }
                 else if ($this->is_funciri_attribute($node->nodeName, $key)) {
                     if (preg_match('/^[a-z:]*url\(/i', $value)) {
-                        if (preg_match('/^([a-z:]*url)\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)/iu', $value, $match)) {
+                        if (preg_match('/^([a-z:]*url)\(\s*[\'"]?([^\'"\)]*)[\'"]?\s*\)?/iu', $value, $match)) {
                             if ($url = $this->wash_uri($match[2])) {
                                 $result .= ' ' . $attr->nodeName . '="' . $match[1]
                                     . '(' . htmlspecialchars($url, ENT_QUOTES, $this->config['charset']) . ')'
diff -Nru roundcube-1.6.17+dfsg/public_html/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php roundcube-1.6.18+dfsg/public_html/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php
--- roundcube-1.6.17+dfsg/public_html/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/public_html/plugins/managesieve/lib/Roundcube/rcube_sieve_script.php	2026-08-09 07:48:13.000000000 +0000
@@ -240,7 +240,7 @@
 
             // header
             if (!empty($rule['name']) && strlen($rule['name'])) {
-                $script .= '# rule:[' . $rule['name'] . "]\r\n";
+                $script .= '# rule:[' . preg_replace('/[\r\n]+/', ' ', $rule['name']) . "]\r\n";
             }
 
             // constraints expressions
diff -Nru roundcube-1.6.17+dfsg/public_html/plugins/markasjunk/drivers/cmd_learn.php roundcube-1.6.18+dfsg/public_html/plugins/markasjunk/drivers/cmd_learn.php
--- roundcube-1.6.17+dfsg/public_html/plugins/markasjunk/drivers/cmd_learn.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/public_html/plugins/markasjunk/drivers/cmd_learn.php	2026-08-09 07:48:13.000000000 +0000
@@ -56,21 +56,24 @@
 
         // backwards compatibility %xds removed in markasjunk v1.12
         $command = str_replace('%xds', '%h:x-dspam-signature', $command);
-        $command = str_replace('%u', escapeshellarg($_SESSION['username']), $command);
-        $command = str_replace('%l', escapeshellarg($rcube->user->get_username('local')), $command);
-        $command = str_replace('%d', escapeshellarg($rcube->user->get_username('domain')), $command);
+
+        $vars = [
+            '%u' => escapeshellarg($rcube->get_user_name()),
+            '%l' => escapeshellarg($rcube->user->get_username('local')),
+            '%d' => escapeshellarg($rcube->user->get_username('domain')),
+        ];
+
         if (strpos($command, '%i') !== false) {
             $identity = $rcube->user->get_identity();
-            $command  = str_replace('%i', escapeshellarg($identity['email']), $command);
+            $vars['%i'] = escapeshellarg($identity['email']);
         }
 
         foreach ($uids as $uid) {
-            // reset command for next message
-            $tmp_command = $command;
+            $replace = $vars;
 
             if (strpos($tmp_command, '%s') !== false) {
-                $message     = new rcube_message($uid);
-                $tmp_command = str_replace('%s', escapeshellarg($message->sender['mailto']), $tmp_command);
+                $message = new rcube_message($uid);
+                $replace['%s'] = escapeshellarg($message->sender['mailto']);
             }
 
             if (!empty($header_names)) {
@@ -86,7 +89,7 @@
                     }
 
                     if (!empty($val)) {
-                        $tmp_command = str_replace('%h:' . $header, escapeshellarg($val), $tmp_command);
+                        $replace['%h:' . $header] = escapeshellarg($val);
                     }
                     else {
                         if ($debug) {
@@ -101,9 +104,10 @@
             if (strpos($command, '%f') !== false) {
                 $tmpfname = tempnam($temp_dir, 'rcmSALearn');
                 file_put_contents($tmpfname, $rcube->storage->get_raw_body($uid));
-                $tmp_command = str_replace('%f', escapeshellarg($tmpfname), $tmp_command);
+                $replace['%f'] = escapeshellarg($tmpfname);
             }
 
+            $tmp_command = strtr($command, $replace);
             $output = shell_exec($tmp_command);
 
             if ($debug) {
diff -Nru roundcube-1.6.17+dfsg/public_html/plugins/password/config.inc.php.dist roundcube-1.6.18+dfsg/public_html/plugins/password/config.inc.php.dist
--- roundcube-1.6.17+dfsg/public_html/plugins/password/config.inc.php.dist	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/public_html/plugins/password/config.inc.php.dist	2026-08-09 07:48:13.000000000 +0000
@@ -456,7 +456,16 @@
 
 // Modoboa Driver options
 // ---------------------
-// put token number from Modoboa server
+// API host. Supported replacement variables:
+// %h - user's IMAP hostname
+// %n - hostname ($_SERVER['SERVER_NAME'])
+// %t - hostname without the first part
+// %d - domain (http hostname $_SERVER['HTTP_HOST'] without the first part)
+// %z - IMAP domain (IMAP hostname without the first part)
+// Note: For security reasons replacement variables are not available if $config['imap_host'] is empty.
+$config['password_modoboa_api_host'] = '%h';
+
+// Modoboa API authentication token
 $config['password_modoboa_api_token'] = '';
 
 
diff -Nru roundcube-1.6.17+dfsg/public_html/plugins/password/drivers/modoboa.php roundcube-1.6.18+dfsg/public_html/plugins/password/drivers/modoboa.php
--- roundcube-1.6.17+dfsg/public_html/plugins/password/drivers/modoboa.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/public_html/plugins/password/drivers/modoboa.php	2026-08-09 07:48:13.000000000 +0000
@@ -35,19 +35,23 @@
 
 class rcube_modoboa_password
 {
-    function save($curpass, $passwd)
+    function save($curpass, $passwd, $username)
     {
         // Init config access
-        $rcmail           = rcmail::get_instance();
-        $ModoboaToken     = $rcmail->config->get('password_modoboa_api_token');
-        $RoudCubeUsername = $_SESSION['username'];
-        $IMAPhost         = $_SESSION['imap_host'];
+        $rcmail = rcmail::get_instance();
+        $token = $rcmail->config->get('password_modoboa_api_token');
+        $host = $rcmail->config->get('password_modoboa_api_host');
+
+        // We don't allow replacement variables when the host name(s) come from the user
+        if (!empty($rcmail->config->get('imap_host'))) {
+            $host = rcube_utils::parse_host($host);
+        }
 
         // Call GET to fetch values from modoboa server
         $curl = curl_init();
 
         curl_setopt_array($curl, [
-            CURLOPT_URL            => "https://" . $IMAPhost . "/api/v1/accounts/?search=" . urlencode($RoudCubeUsername),
+            CURLOPT_URL            => "https://" . $host . "/api/v1/accounts/?search=" . urlencode($username),
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_ENCODING       => "",
             CURLOPT_MAXREDIRS      => 10,
@@ -55,7 +59,7 @@
             CURLOPT_HTTP_VERSION   => CURL_HTTP_VERSION_1_1,
             CURLOPT_CUSTOMREQUEST  => "GET",
             CURLOPT_HTTPHEADER     => [
-                "Authorization: Token " . $ModoboaToken,
+                "Authorization: Token " . $token,
                 "Cache-Control: no-cache",
                 "Content-Type: application/json"
             ],
@@ -91,7 +95,7 @@
         $curl = curl_init();
 
         curl_setopt_array($curl, [
-            CURLOPT_URL            => "https://" . $IMAPhost . "/api/v1/accounts/" . $userid . "/",
+            CURLOPT_URL            => "https://" . $host . "/api/v1/accounts/" . $userid . "/",
             CURLOPT_RETURNTRANSFER => true,
             CURLOPT_ENCODING       => "",
             CURLOPT_MAXREDIRS      => 10,
@@ -100,7 +104,7 @@
             CURLOPT_CUSTOMREQUEST  => "PUT",
             CURLOPT_POSTFIELDS     => "" . $encoded . "",
             CURLOPT_HTTPHEADER     => [
-                "Authorization: Token " . $ModoboaToken,
+                "Authorization: Token " . $token,
                 "Cache-Control: no-cache",
                 "Content-Type: application/json"
             ],
diff -Nru roundcube-1.6.17+dfsg/public_html/plugins/password/drivers/zxcvbn.php roundcube-1.6.18+dfsg/public_html/plugins/password/drivers/zxcvbn.php
--- roundcube-1.6.17+dfsg/public_html/plugins/password/drivers/zxcvbn.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/public_html/plugins/password/drivers/zxcvbn.php	2026-08-09 07:48:13.000000000 +0000
@@ -1,5 +1,7 @@
 <?php
 
+use ZxcvbnPhp\Zxcvbn;
+
 /**
  * Zxcvb Password Strength Driver
  *
diff -Nru roundcube-1.6.17+dfsg/tests/Framework/TnefDecoder.php roundcube-1.6.18+dfsg/tests/Framework/TnefDecoder.php
--- roundcube-1.6.17+dfsg/tests/Framework/TnefDecoder.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/tests/Framework/TnefDecoder.php	2026-08-09 07:48:13.000000000 +0000
@@ -79,6 +79,42 @@
     }
 
     /**
+     * Test that a truncated compressed-RTF payload does not cause
+     * out-of-bounds string reads (PHP warnings) in _decompressRTF().
+     */
+    public function test_decompressRTF_truncated()
+    {
+        $tnef = new \rcube_tnef_decoder();
+
+        $method = new \ReflectionMethod('rcube_tnef_decoder', '_decompressRTF');
+
+        // First byte is a flags byte with bit 0 set, so the back-reference
+        // branch is taken. The branch needs two more bytes (offset + length),
+        // but the payload is truncated right after the flags byte. On
+        // unmodified code this triggers "Uninitialized string offset" warnings.
+        $truncated = [
+            "\x01",           // flags byte only, no data follows
+            "\x01\x00",       // flags + offset, length byte missing
+            "\x00\x00",       // literal branch, then out of data mid-loop
+        ];
+
+        // Turn PHP warnings/notices into exceptions so we can assert cleanly.
+        set_error_handler(static function ($errno, $errstr) {
+            throw new \ErrorException($errstr, 0, $errno);
+        });
+
+        try {
+            foreach ($truncated as $data) {
+                // A large $size forces the loop to keep consuming input.
+                $result = $method->invoke($tnef, $data, 1000);
+                $this->assertIsString($result);
+            }
+        } finally {
+            restore_error_handler();
+        }
+    }
+
+    /**
      * Test rtf2text()
      */
     function test_rtf2text()
diff -Nru roundcube-1.6.17+dfsg/tests/Framework/Utils.php roundcube-1.6.18+dfsg/tests/Framework/Utils.php
--- roundcube-1.6.17+dfsg/tests/Framework/Utils.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/tests/Framework/Utils.php	2026-08-09 07:48:13.000000000 +0000
@@ -597,14 +597,22 @@
             ['http://0.0.0.0:8080', true],
             ['http://[::ffff:127.0.0.1]:8080', true],
             ['http://127.0.0.1.nip.io', true],
+            ['http://fc00--1.nip.io', true],
+            ['http://--1.nip.io', true],
+            ['http://127-0-0-1.nip.io', true],
+            ['http://7F000001.nip.io/', true],
             ['http://metadata.google.internal', true],
             ['http://127.0.0.1.sslip.io/', true],
             ['http://[0:0:0:0:0:ffff:127.0.0.1]/', true],
             ['http://0/', true],
+            ['http://100.64.0.1', true],
+            ['http://[fe80::1]', true],
             // Non-local hosts
             ['http://[2001:470::76:0:0:0:2]', false],
             ['http://domain.tld', false],
             ['http://20.0.0.1.nip.io', false],
+            ['http://www-20-0-0-1.nip.io', false],
+            ['http://40b01609.nip.io/', false],
         ];
     }
 
diff -Nru roundcube-1.6.17+dfsg/tests/Framework/Washtml.php roundcube-1.6.18+dfsg/tests/Framework/Washtml.php
--- roundcube-1.6.17+dfsg/tests/Framework/Washtml.php	2026-07-05 10:42:51.000000000 +0000
+++ roundcube-1.6.18+dfsg/tests/Framework/Washtml.php	2026-08-09 07:48:13.000000000 +0000
@@ -508,6 +508,10 @@
                 '<svg><defs><filter><feImage x-washed="xlink:href"></feImage></filter></defs></svg>',
             ],
             [
+                '<svg><rect fill="url(http://attacker.com"/></svg>',
+                '<svg><rect x-washed="fill" /></svg>',
+            ],
+            [
                 '<svg><animate attributeName="mask" values="url(https://external.site)" fill="freeze" dur="0.1s" /></svg>',
                 '<svg><!-- animate blocked --></svg>',
             ],
@@ -537,6 +541,10 @@
                 '<svg><rect><animate attributeName="style" values="position:fixed;top:0;left:0" dur="0s" fill="freeze"/></rect></svg>',
                 '<svg><rect><animate attributeName="style" values="position: absolute; top: 0; left: 0" dur="0s" fill="freeze" /></rect></svg>',
             ],
+            [
+                '<svg><rect><animate attributeName="style" by="filter:url(http://attacker.example/track)" dur="0s" fill="freeze"/></rect></svg>',
+                '<svg><rect><animate attributeName="style" dur="0s" fill="freeze" x-washed="by" /></rect></svg>',
+            ],
         ];
     }