Mail Header Injection Vulnerability in Roundcube Webmail by Roundcube
CVE-2026-114716

8.5HIGH

Key Information:

Vendor

Roundcube

Status
Webmail
Vendor
CVE Published:
22 October 2026

What is CVE-2026-114716?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are susceptible to a mail header injection issue. This vulnerability arises from improper validation of the media type in inline image data URIs, allowing a remote authenticated attacker to craft and inject harmful MIME part headers into outgoing messages through the use of CRLF sequences. The bug has been addressed in the latest releases, with enhanced validation implemented to ensure only safe media types are processed, thus protecting users from potential exploitation.

Affected Version(s)

Webmail 1.6.0 < 1.6.20

Webmail 1.7.0 < 1.7.5

References

https://bugs.debian.org/1151279
issue-trackingthird-party-advisory
https://github.com/roundcube/roundcubemail/commit/7f3cc9c...
patch
https://roundcube.net/news/2026/10/19/security-updates-1....
vendor-advisoryrelease-notes

CVSS V3.1

Score:
8.5
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.