{"id":"CVE-2026-114716","kind":"vulnerability","aliases":["CVE-2026-114716"],"related":[],"title":"Roundcube Webmail: crafted inline image lets attackers inject mail headers","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().","summary":"Roundcube does not validate the media type in inline image data URIs when it builds outgoing mail, so CRLF sequences in that type can add arbitrary MIME part headers to the message. An authenticated attacker can use this to alter how the sent email is structured.","severity":"high","cvss":8.5,"epss":0.0039,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["email","package","roundcube","self-hosted","webmail"],"not_affected_if":["no-webmail","patched-version"],"how_to_check":"- Check the installed Roundcube version in `program/include/iniset.php` or the release tag; versions below `1.6.20` on the 1.6 line and below `1.7.5` on the 1.7 line are affected\n- Confirm whether the instance is reachable by users who can compose and send mail","fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` or later on the 1.7 line\n- Upstream fix is the commit validating the media type with `rcube_mime::is_mimetype_valid()`","status":"open","published_at":"2026-10-22T02:16:59+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:00:20+00:00","updated_at":"2026-10-25T03:00:20+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T03:00:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` or later on the 1.7 line\n- Upstream fix is the commit validating the media type with `rcube_mime::is_mimetype_valid()`","reach":"internet","title":"Roundcube Webmail: crafted inline image lets attackers inject mail headers","impact":"medium","summary":"Roundcube does not validate the media type in inline image data URIs when it builds outgoing mail, so CRLF sequences in that type can add arbitrary MIME part headers to the message. An authenticated attacker can use this to alter how the sent email is structured.","category":"package","nicknames":[],"who_cares":["roundcube","self-hosted","webmail","email"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker injects arbitrary MIME headers into outgoing messages sent through Roundcube","analyst_note":"","how_to_check":"- Check the installed Roundcube version in `program/include/iniset.php` or the release tag; versions below `1.6.20` on the 1.6 line and below `1.7.5` on the 1.7 line are affected\n- Confirm whether the instance is reachable by users who can compose and send mail","needs_analyst":false,"not_affected_if":["patched-version","no-webmail"],"who_is_affected":"Any Roundcube Webmail installation on the affected versions where users can log in and compose messages with inline images is exposed, since the flaw sits in the send path. Instances that are not running Roundcube, or are already on the patched releases, can skip it. Whether mail routing or DKIM-signed mail is affected beyond header injection is unknown.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000653,"input_tokens":3456,"output_tokens":614,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-114716':13A,16A '-2026':12A,15A '1.6.20':73C '1.7':75C '1.7.5':78C 'add':48B 'affect':80C 'alter':63B 'arbitrari':49B,113C 'attack':7A,58B,110C 'authent':57B,109C 'build':38B 'commit':134C 'could':111C 'craft':3A 'crlf':42B,123C 'cve':11A,14A 'data':34B,101C,146C 'email':17B,67B 'extract':89C 'fix':130C,135C 'header':10A,52B,84C,116C,137C 'host':22B 'imag':5A,33B,91C,100C,145C 'inject':8A,85C,112C,138C 'inlin':4A,32B,90C,99C,144C 'let':6A 'mail':9A,40B,83C,136C 'media':29B,94C,127C,140C,151C 'messag':55B,120C 'mime':50B,114C,155C 'mimetyp':157C 'outgo':39B,119C 'packag':18B 'part':51B,115C 'place':122C 'rcmail':87C 'rcube':154C 'remot':108C 'roundcub':1A,19B,24B,70C 'self':21B 'self-host':20B 'sendmail':88C 'sent':66B 'sequenc':43B,124C 'structur':69B 'taken':96C 'type':30B,46B,95C,128C,141C,152C 'upstream':129C 'uri':35B,102C,147C 'use':60B,92C 'valid':27B,104C,149C,158C 'via':139C 'vulner':86C 'webmail':2A,23B,71C 'without':103C 'x':76C","nicknames":[],"mitigations":[],"who_affected":"Any Roundcube Webmail installation on the affected versions where users can log in and compose messages with inline images is exposed, since the flaw sits in the send path. Instances that are not running Roundcube, or are already on the patched releases, can skip it. Whether mail routing or DKIM-signed mail is affected beyond header injection is unknown.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114716","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114716","severity":null,"published_at":"2026-10-22T02:16:59+00:00","modified_at":"2026-10-22T16:45:49+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114716","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114716","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}