Mail Header Injection Vulnerability in Roundcube Webmail by Ikonate

CVE-2026-114717

What is CVE-2026-114717?

Roundcube Webmail is susceptible to a mail header injection vulnerability that occurs when messages are forwarded as attachments. Specifically, the subject line of the original message can be exploited to insert arbitrary MIME part headers into outgoing messages. This happens due to the use of subject text directly in the attachment naming process, where CRLF sequences can allow attackers to manipulate the headers. The issue has been addressed in recent updates, which sanitize the generated attachment names by collapsing excessive whitespace, thus mitigating the threat.

References