| Roundcube | |
|---|---|
 | |
 | |
| Original author | Thomas Bruederli |
| Developer | The Roundcube Team [1] |
| Initial release | March 4, 2008 |
| Stable release | |
| Written in | PHP |
| Operating system | Cross-platform |
| Type | Webmail |
| License | GPL-3.0-or-later with exceptions for skins and plugins [3] |
| Website | roundcube |
| Repository | github |
Roundcube is a web-based IMAP email client written in PHP. It uses Ajax throughout its interface and is licensed under the GNU GPL version 3 or later, with exceptions for skins and plugins. [3]
After roughly two years of development, the first stable release of Roundcube was announced on March 4, 2008. [4] cPanel adopted Roundcube as its bundled webmail client, replacing SquirrelMail.
On May 3, 2015, Roundcube announced, in partnership with Kolab Systems AG, a plan to completely rewrite the application as Roundcube Next. A crowdfunding campaign was set up to finance the project. The $80,000 goal was reached on June 24, 2015, [5] and the final amount raised was US$103,541. [6] Roundcube Next was intended to add calendar, chat, and file management features using WebRTC, with connectors for services such as Dropbox and ownCloud. Kolab Systems and Roundcube halted development in 2016, and backers received no updates or refunds. [7] A Roundcube developer later stated that the project had no ownership over the Roundcube Next campaign. [8]
In November 2023, Nextcloud announced a partnership with Roundcube. [9] [10]
Roundcube runs on standard web servers such as Apache, LiteSpeed, Nginx, and Lighttpd, and can be deployed on any operating system that supports PHP. It works with a LAMP stack or comparable environment. The web server requires access to an IMAP server for reading mail and an SMTP server for sending. Supported databases are MySQL, PostgreSQL, and SQLite.
The user interface is rendered in XHTML and CSS and is fully customizable through skins. Roundcube ships with jQuery and additional libraries including GoogieSpell and TinyMCE.
Roundcube supports over 70 interface languages and connects to any IMAPv4 server with encrypted TLS connections. The interface uses Ajax to enable drag-and-drop message management, threaded message listing, and find-as-you-type address-book lookup. It provides full support for MIME and HTML messages, rich-text composition, multiple sender identities, and spell checking. The address book supports vCard, group management, and LDAP directory integration. Additional capabilities include PGP encryption via Mailvelope, OAuth authentication, shared and global IMAP folders with ACL support, IDNA support, and a template system for custom themes.
In 2023, the pro-Russia hacking group Winter Vivern [11] exploited a cross-site scripting vulnerability in Roundcube to attack European government entities and a think tank, as reported by researchers from ESET. [12] Opening a malicious email was sufficient to trigger the exploit, which could read folder contents and forward messages to attacker-controlled servers. [13]
