Roundcubemail just released new 0.9.5 version with fixes for VCE2013-6172(will be available soon).

Hotfix: https://github.com/roundcube/roundcubemail/commit/4109bb26ce.diff

Full announcement:

We just published new releases which fix a recently reported vulnerability that allows an attacker to overwrite configuration settings using user preferences. This can result in random file access, manipulated SQL queries and even code execution. The latter one only affects versions 0.8.6 and older.

Beside the security fix, the 0.9.5 release also includes other minor bug fixes and improvements. Most notably it brings the default spell checker back after Google suspended their public spell checking service.