Live › vulnerability › CVE-2026-114717
Go to dashboardRoundcube builds the attachment name for a forwarded message directly from that message's subject, without stripping line breaks. A received email whose subject contains CRLF sequences can therefore inject extra MIME part headers into the outgoing message.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any self-hosted or managed Roundcube deployment on the affected versions where users forward messages as attachments. Injection affects outgoing mail composed by users who receive hostile subjects, so exposure depends on accepting mail from untrusted senders. Deployments already on 1.6.20 or 1.7.5 or later are not affected.
No product ranges from the sources yet.
1.6.x below 1.6.20 or 1.7.x below 1.7.5 is affected.program/include/iniset.php version constant.1.6.20 or later on the 1.6 line, or to 1.7.5 or later on the 1.7 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.
This page as .md · .json · in your agent: get_signal("CVE-2026-114717")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.