[ CVE-2026-113386 · Published 20 Oct 2026 ]
Vulnerability in Roundcube Webmail
CVSS 7.1
EPSS <1%1 agency advisoryNo fix listed yet
[ Description ]Official description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.
[ Advisories ]Government CERT advisories
-
BSI CERT-BundWID-SEC-2026-4043
Roundcube Webmail: Multiple vulnerabilities Translated from German
[ References ]References
- bugs.debian.org/1151279
- github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a
- github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049
- github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
- github.com/roundcube/roundcubemail/releases/tag/1.6.20
- github.com/roundcube/roundcubemail/releases/tag/1.7.5
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5