Live › vulnerability › CVE-2026-114716
Go to dashboardRoundcube does not validate the media type in inline image data URIs when it builds outgoing mail, so CRLF sequences in that type can add arbitrary MIME part headers to the message. An authenticated attacker can use this to alter how the sent email is structured.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail installation on the affected versions where users can log in and compose messages with inline images is exposed, since the flaw sits in the send path. Instances that are not running Roundcube, or are already on the patched releases, can skip it. Whether mail routing or DKIM-signed mail is affected beyond header injection is unknown.
No product ranges from the sources yet.
program/include/iniset.php or the release tag; versions below 1.6.20 on the 1.6 line and below 1.7.5 on the 1.7 line are affected1.6.20 on the 1.6 line or 1.7.5 or later on the 1.7 linercube_mime::is_mimetype_valid()Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
This page as .md · .json · in your agent: get_signal("CVE-2026-114716")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.