# changelog

author: Tim College <tcollege@interworx.com>
changelog:
  - Backport Roundcube 1.5.x security fixes (IWX-15029): draft-restore stored XSS,
    SVG animate style CSS injection, CSS var() image-block bypass, virtuser_query
    SQLi hardening (CVE-2026-48842), TNEF winmail.dat DoS, attachment MIME-type
    stored XSS (CVE-2026-54432), plain-text zero-click XSS (CVE-2026-54433)


