Live › vulnerability › CVE-2026-113386
Go to dashboardRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 does not strip CRLF sequences from the _uid parameter of the mail/headers and mail/viewsource actions. A logged-in user can inject arbitrary IMAP commands into the mail server session, which can read or change mail beyond their own view.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any deployment of Roundcube Webmail on the affected version ranges is exposed, since the flaw sits in the mail/headers and mail/viewsource handlers that every logged-in user reaches. Exposure needs a valid webmail account, so internet-facing instances with open or self-registration are the main concern. Installations limited to trusted internal users carry less risk but still need the upgrade.
No product ranges from the sources yet.
CHANGELOG.md, or composer show roundcube/roundcubemail where installed via Composer.1.6.20 on the 1.6 line or below 1.7.5 on the 1.7 line.1.6.20 or later on the 1.6 line, or to 1.7.5 or later on the 1.7 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
This page as .md · .json · in your agent: get_signal("CVE-2026-113386")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.