diff --git a/CHANGELOG b/CHANGELOG
index 1f2e116659e..c6637e47cff 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -52,6 +52,7 @@ CHANGELOG Roundcube Webmail
 - Fix various issues when downloading files with names containing non-ascii chars, use RFC 2231 (#5772)
 - Fix decoding of mailto: links with + character in HTML messages (#6020)
 - Fix false reporting of failed upgrade in installto.sh (#6019)
+- Fix file disclosure vulnerability caused by insuficient input validation in relation to attachment plugins (#6026)
 
 RELEASE 1.3.2
 -------------