CVE-2026-114725: Medium severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmailsendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
Roundcube Webmailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Which deployments are affected?
Roundcube Webmail versions before 1.6.20 and 1.7.x versions before 1.7.5 are affected. The issue is in outgoing-message handling when certain header values are supplied through request parameters.
What does an attacker need to exploit this?
An attacker needs an authenticated Roundcube account and network access to the affected instance. No user interaction is required.
Which message fields can be used for header injection?
The affected request parameters are References, In-Reply-To, Message-ID, and From. Prior handling removed newline characters only from Subject and Organization, leaving these string header values insufficiently sanitized.
What is the remediation?
Upgrade to Roundcube 1.6.20 or, for the 1.7 branch, 1.7.5. The upstream fix normalizes whitespace in every string header value.