UBUNTU-CVE-2026-126813: Command Injection

Published Nov 12, 2026

Updated

Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the uid parameter when messagescache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.

Affected Software

7 affected components

ubuntu/roundcube*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.6.21
Upgrade
Upgrade Roundcube Webmail to a version that resolves this vulnerability.
Fixed in 1.7.6

Event History

Nov 12, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Roundcube users who are already logged in are exposed when messages_cache is enabled and they open a crafted GET link to the mail/show or mail/get endpoint. The affected versions are before 1.6.21 and 1.7.x before 1.7.6.

What does an attacker need to exploit it?

The attacker needs to lure a logged-in victim into opening a crafted URL containing CRLF characters in the _uid parameter. The vulnerability requires messages_cache to be enabled.

What could an attacker do through a successful exploit?

Injected IMAP commands can delete messages, modify message flags, or grant mailbox access through SETACL. The actions occur through the victim's authenticated Roundcube session.