RoundCube 1.5.12 Released

[Starburst]

FYI to all - RoundCube 1.5.12 was released 2025-12-13

If you need help updating, please see:
https://starburst.help/control-web-panel-cwp/control-web-panel-cwp-admin-tutorials/update-roundcube-webmail-to-version-1-5-12-in-cwp-on-almalinux-8-9/

[Watchdog]

ive tried multiple times to upgrade but i always get the "Internal Server Error"

Ive followed your instructions step by step but just cant seem to get it to run.

Code Select Expand


NOTICE: New .htaccess file saved as .htaccess.new.
NOTICE: The 'installer' directory still exists. You should remove it after the upgrade.

Running update script at target...
Executing database schema update.
NOTICE: Update dependencies by running `php composer.phar update --no-dev`
This instance of Roundcube is up-to-date.
Have fun!
All done.

[Starburst]

What OS & PHP version are you running?

If that is the server running those other .repos you where asking about, that could be the cause also.

[Watchdog]

Im running  AlmaLinux release 8.10 (Cerulean Leopard) with PHP version: 8.1.33.

Ive removed those repos but ive been having this problem before those repos were added

[overseer]

Likewise I'm running AL 8.10 with PHP 8.1.33 as the main command line PHP and also the primary php-fpm version for maximum WordPress compatibility. I have updated all my servers with Starburst's instructions and the only odd thing I had to do was restart cwpsrv afterward as some clients were having troubles accessing the webmail until that service was restarted.

Note that Roundcube runs under CWP's nginx and internal PHP version (actually 7.2) -- labeled as 7.1.
Can you give a list of your repos?

[Watchdog]

Here is my list:

Code Select Expand

# ls /etc/yum.repos.d/
almalinux-ha.repo                cwp.repo
almalinux-nfv.repo               epel-modular.repo
almalinux-plus.repo              epel.repo
almalinux-powertools.repo        epel.repo.rpmnew
almalinux.repo                   epel-testing-modular.repo
almalinux-resilientstorage.repo  epel-testing.repo
almalinux-rt.repo                mariadb.repo
almalinux-saphana.repo           mariadb.repo.bak
almalinux-sap.repo               nginx.repo

Im not using fpm at the moment.
Could you maybe send me your repolist so i can compare it to mine?

[Starburst]

At https://forum.centos-webpanel.com/php-selector/cant-install-any-alt-php-version/msg52891/?topicseen#msg52891

You listed different repos installed on the server, and having a problem with PHP.

So what repos are really installed?

[Watchdog]

I couldnt upgrade roundcube long before i started having problems with my php.

Ive only removed the 3 redundant repos from the list:
pgdg-redhat-all.repo
cloudlinux.repo
alt-php.repo

[Watchdog]

I found the solution for the "Internal Server Error" after logging into roundcube after the upgrade:

disable the spoof check
Edit the file:

Code Select Expand

nano /usr/local/cwpsrv/var/services/roundcube/program/lib/Roundcube/rcube_spoofchecker.php
Around line 50, you'll see something like:

Code Select Expand

PHP// Spoofchecker is part of ext-intl (requires ICU >= 4.2)
$checker = new Spoofchecker();
Insert this line right before the $checker = ... line:

Code Select Expand

return false;
So it looks like:

Code Select Expand

return false;
// Spoofchecker is part of ext-intl (requires ICU >= 4.2)
$checker = new Spoofchecker();
Save and exit.
Then restart:

Code Select Expand

sh /scripts/restart_cwpsrv

[ATP]

The general problem might be the absence of the PHP 'intl' module in the CWP's internal PHP.

/usr/local/cwp/php71/bin/php -v
cd /usr/local/src
wget https://museum.php.net/php7/php-7.2.30.tar.gz
tar xzf php-7.2.30.tar.gz
cd php-7.2.30/ext/intl
/usr/local/cwp/php71/bin/phpize
./configure --with-php-config=/usr/local/cwp/php71/bin/php-config --with-icu-dir=/usr
make -j$(nproc)
make install
/usr/local/cwp/php71/bin/php -m | grep intl
/scripts/restart_cwpsrv

[overseer]

It's a prerequisite; see directions here:
https://www.alphagnu.com/topic/33-update-cwp-roundcube-mail-version-158-%E2%80%93-control-web-panel/

Code Select Expand

dnf update ca-certificates -y
dnf install -y libicu50
rpm -ivh https://github.com/mysterydata/md-disk/raw/main/libicu69-69.1-4.el8.x86_64.rpm
curl -s -L https://www.alphagnu.com/upload/tmp/el8/cwp_rc_fix_el8.sh | bash

[ghoste]

Hey guys, how do I update Roundcube on CWP? Is there a procedure to do it without crashing the servers? Or does CWP not support newer versions of Roundcube?

And, without any complicated workarounds, you can simply place the Roundcube version on a subdomain and configure the PHP version via "Manage WebServers Configuration."

I'm losing my mind here—I've got 25 CWP Pro servers.

This is a security update to the version 1.7 of Roundcube Webmail.
It provides fixes to recently reported security vulnerabilities:
Fix IMAP command injection via CRLF in _uid parameter of mail/headers and mail/viewsource action, reported by Wahab "NeoX" K.
Fix bug where an alias login wasn't qualified by IMAP host, reported by Milan Hoppe.
Add a size limit to the CSS proxy content processing, reported by Milan Hoppe.
Fix SSRF filter (is_local_url()) bypass via NAT64 64:ff9b::/96, reported by dizconnect.
Fix remote content blocking bypass via SVG SMIL by attribute, reported by Milan Hoppe.
Fix remote content blocking bypass via CSS escapes in FuncIRI attributes (again), reported by Milan Hoppe.
Fix passing potentally unsafe attachment content into ImageMagick on image resize, reported by Paulos Yibelo
Fix mail header injection via the From display-name in the Bounce (resend) action, reported by Clay.
Fix mail header injection via References/In-Reply-To/Message-ID/From parameters, reported by Sunil Tripathy.
Fix object injection primitive in rcube_session::unserialize() via "!"-prefixed session keys, reported by Oli Z.
Fix ImageMagick resource limits bypass by GD fallback during thumbnail generation, reported by GoldenSW.
Fix CSS scoping bypass in HTML messages using at-rules, reported by GoldenSW.
Fix bug where deprecated action aliases bypassed disabled_actions setting, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix IMAP command injection via CRLF in _flag parameter of mail/mark action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix CSRF validation bypass in the mark-as-junk action, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix XSS issue in handling of password driver error responses, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix mail header injection via subject of a message forwarded as attachment, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix mail header injection via media type in an inline image data URI, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix bug where Password Modoboa driver could change password for another account, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.
Fix unsafe use of a login name in SquirrelMail import file path, reported by Squirt1e, Atum, N0b0dy, and Gh0u1L5.

This version is considered stable and we recommend to update all productive installations of Roundcube with it. Please do backup your data before updating!
https://github.com/roundcube/roundcubem ... /tag/1.7.5

[overseer]

To be compatible with CWP, you need to use the 1.5.x LTS branch of Roundcube. So the end of the line is 1.5.15, released at the end of March this year. Development of 1.5.x should be frozen now, unless there's some doomsday zero day that compels them to do a final clean-up update -- but that is very unlikely.

[Starburst]

CWP still uses PHP 7.1 as a backend, and isn't compatible with Roundcube 1.6 or 1.7

Roundcube 1.6 requires PHP 7.3 to 8.1

Roundcube 1.7 requires PHP 8.1 to 8.5


So until CWP stops their support for the obsolete CentOS 7 and updates the code for AL9 and AL10, neither of the 2 current versions of Roundcube will be supported.

[Netino]

You can use `cwpsvc` user sockets to run Roundcube on more recent versions (1.6 and 1.7).

Try using one of the available sockets found here:

Code Select Expand


# ls -alF /opt/alt/php-fpm*/usr/etc/php-fpm.d/cwpsvc.conf
-rw-r--r--  1 root root 632 Aug 22 21:03 /opt/alt/php-fpm74/usr/etc/php-fpm.d/cwpsvc.conf
-rw-r--r--. 1 root root 632 Aug 17 03:56 /opt/alt/php-fpm82/usr/etc/php-fpm.d/cwpsvc.conf
-rw-r--r--  1 root root 632 Aug 17 04:06 /opt/alt/php-fpm84/usr/etc/php-fpm.d/cwpsvc.conf


The real sockets you can find with:

Code Select Expand


# grep sock /opt/alt/php-fpm*/usr/etc/php-fpm.d/cwpsvc.conf
/opt/alt/php-fpm74/usr/etc/php-fpm.d/cwpsvc.conf:listen = /opt/alt/php-fpm74/usr/var/sockets/cwpsvc.sock
/opt/alt/php-fpm82/usr/etc/php-fpm.d/cwpsvc.conf:listen = /opt/alt/php-fpm82/usr/var/sockets/cwpsvc.sock
/opt/alt/php-fpm84/usr/etc/php-fpm.d/cwpsvc.conf:listen = /opt/alt/php-fpm84/usr/var/sockets/cwpsvc.sock

The sockets are the files with .sock extension.

Since I have php-fpm74, php-fpm82, and php-fpm84, you can edit the following file:

Code Select Expand

/usr/local/cwpsrv/conf.d/webmail.conf

Locate the line:

Code Select Expand


fastcgi_pass    unix:/usr/local/cwp/php71/var/sockets/cwpsvc.sock;


Replace it with one of the available sockets, for example:

Code Select Expand


#fastcgi_pass    unix:/usr/local/cwp/php71/var/sockets/cwpsvc.sock;
fastcgi_pass    unix:/opt/alt/php-fpm74/usr/var/sockets/cwpsvc.sock;


Then, restart CWP:

Code Select Expand

# /scripts/restart_cwpsrv

However, I did this out of *necessity*, as a security solution for Roundcube is required. However, if you choose to use the solution mentioned above—while it is simple—you must take responsibility for monitoring any automatic changes to the `webmail.conf` file that might occur during a normal CWP upgrade.
That said, I can share that I have been using this approach for a month now, and I haven't encountered any issues.

Best regards,
Netino