CVE-2026-114726: Medium severity Roundcube Roundcube Webmail vulnerability
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcubemime::decodeaddresslist() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.6.20 - Upgrade
Upgrade
roundcube/roundcubemailto a version that resolves this vulnerability.Fixed in 1.7.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
Roundcube Webmail installations running versions before 1.6.20 or 1.7.x versions before 1.7.5 are affected. Exposure requires users to use the Bounce (resend) action on a received message.
What does an attacker need to do to exploit it?
An attacker needs to send a message with CRLF control characters embedded in an encoded word in the From display name. When a recipient bounces that message, the injected characters can add arbitrary headers to the emitted message.
Does exploitation require authentication or user interaction?
The attacker does not need authentication, but exploitation requires a Roundcube user to bounce the attacker-controlled received message. The vulnerable processing occurs during that Bounce (resend) action.
What versions contain the fix?
The issue is fixed in Roundcube Webmail 1.6.20 and 1.7.5. Upgrading to the applicable fixed release removes the vulnerable handling of control characters in decoded display names.