CVE-2026-113386: CRLF Injection
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be able to authenticate to Roundcube Webmail and make requests to the mail/headers or mail/viewsource actions. The issue is remotely exploitable and does not require user interaction.
Which deployments are affected?
Roundcube Webmail versions before 1.6.20 are affected, as are 1.7.x versions before 1.7.5.
What access does successful exploitation provide?
A successful attacker can inject CRLF sequences into the _uid parameter and execute arbitrary IMAP commands. The reported impact includes high integrity impact and low confidentiality impact.