---
id: "CVE-2026-114716"
kind: "vulnerability"
aliases: ["CVE-2026-114716"]
title: "Roundcube Webmail: crafted inline image lets attackers inject mail headers"
severity: "high"
cvss: 8.5
epss: 0.0039
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["email", "package", "roundcube", "self-hosted", "webmail"]
not_affected_if: ["no-webmail", "patched-version"]
published_at: "2026-10-22T02:16:59+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-25T03:00:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-114716", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-114716", "first_seen_at": "2026-10-24T07:15:52+00:00"}]
---

# Roundcube Webmail: crafted inline image lets attackers inject mail headers

Roundcube does not validate the media type in inline image data URIs when it builds outgoing mail, so CRLF sequences in that type can add arbitrary MIME part headers to the message. An authenticated attacker can use this to alter how the sent email is structured.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Roundcube version in `program/include/iniset.php` or the release tag; versions below `1.6.20` on the 1.6 line and below `1.7.5` on the 1.7 line are affected
- Confirm whether the instance is reachable by users who can compose and send mail

## Fix

- Upgrade Roundcube Webmail to `1.6.20` on the 1.6 line or `1.7.5` or later on the 1.7 line
- Upstream fix is the commit validating the media type with `rcube_mime::is_mimetype_valid()`

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-114716
- 2026-10-24T07:15:52+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-114716

## From the sources

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_