CVE-2026-114717: Medium severity Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments require remediation?
Roundcube Webmail versions before 1.6.20 are affected, as are 1.7.x versions before 1.7.5. Upgrade to the applicable fixed release.
What conditions are needed for exploitation?
An attacker must cause a message with CRLF sequences in its subject to be received. The issue is triggered when that received message is forwarded as an attachment.
What is the impact on the forwarded email?
The crafted subject can inject arbitrary MIME-part headers into the outgoing forwarded message. The affected behavior used the subject verbatim when generating the attachment name.
What can be done before an upgrade is available?
Avoid forwarding received messages as attachments, particularly messages with suspicious or malformed subjects. The upstream fix collapses whitespace in the generated attachment name.