Mail Header Injection Vulnerability in Roundcube Webmail

CVE-2026-114726

What is CVE-2026-114726?

Roundcube Webmail versions prior to 1.6.20 and 1.7.x before 1.7.5 are susceptible to a mail header injection vulnerability. Specifically, the issue arises in the Bounce (resend) action where the function rcube_mime::decode_address_list() fails to adequately cleanse control characters from the decoded display name. This oversight allows an attacker to exploit a received message with a From display-name that contains CRLF sequences in an encoded word, thereby injecting arbitrary headers when the user attempts to bounce the message. A fix addressing this vulnerability has been implemented in versions 1.6.20 and 1.7.5.

References