CVE-2026-114716: High severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail::extractinlineimages() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcubemime::ismimetypevalid().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which Roundcube versions require an update?
Roundcube Webmail versions before 1.6.20 are affected, as are 1.7.x versions before 1.7.5. Updating to 1.6.20 or 1.7.5 addresses the issue.
What level of access does an attacker need?
An attacker must be remotely authenticated to Roundcube. Exploitation does not require user interaction and has low attack complexity.
What must an attacker supply to exploit the issue?
The attacker needs to place CRLF sequences in the media type of an inline image data URI. This allows injection of arbitrary MIME-part headers into an outgoing message.
What changed in the fix?
The fix validates the inline image data URI media type using rcube_mime::is_mimetype_valid(), preventing unvalidated media types from being used in MIME-part construction.