IMAP Command Injection in Roundcube Webmail by Roundcube
CVE-2026-113386

7.1HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113386?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are vulnerable to an IMAP command injection flaw. An authenticated attacker can exploit this issue by injecting CRLF sequences into the _uid parameter during mail/headers and mail/viewsource actions. This allows for the execution of arbitrary IMAP commands, posing a significant risk to users' email accounts and data integrity.

Affected Version(s)

Webmail 1.6.0 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/004adaa...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.