CVE-2026-114720: CRLF Injection
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in flag parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker must be authenticated to the Roundcube Webmail instance. No user interaction is required, and the attack can be performed over the network.
Which deployments are affected?
Roundcube Webmail versions before 1.6.20 and 1.7.x versions before 1.7.5 are affected. The vulnerable functionality is the mail/mark action when handling the _flag parameter.
What does successful exploitation allow?
An authenticated attacker can inject CRLF sequences into the _flag parameter and execute arbitrary IMAP commands. The stated impact includes high integrity impact and low confidentiality impact.
What changes in the fix?
The upstream fix rejects _flag values containing control characters, whitespace, or IMAP-special characters, preventing CRLF-based IMAP command injection.