Mail Header Injection Vulnerability in Roundcube Webmail

CVE-2026-114725

What is CVE-2026-114725?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 exhibit a mail header injection vulnerability. The vulnerability arises from the rcmail_sendmail function, which inadequately sanitizes certain mail header values derived from user input. Although the Subject and Organization headers have their newline characters stripped, other headers such as References, In-Reply-To, Message-ID, and From have been left open to remote attackers. This oversight allows authenticated users to inject arbitrary headers into outgoing emails, potentially leading to data breaches or phishing attacks. The vulnerability has been addressed in recent updates wherein whitespace normalization is applied to all string header values.

References