Live › vulnerability › CVE-2026-114720
Go to dashboardRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 does not filter CRLF sequences in the _flag parameter of the mail/mark action. A logged-in user can inject arbitrary IMAP commands into the mailbox session on the mail server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail deployment on a version before 1.6.20 or in the 1.7.x line before 1.7.5 is exposed. The attacker needs a valid mailbox login, so the risk is to shared or multi-tenant webmail where users are not fully trusted.
No product ranges from the sources yet.
CHANGELOG.md or the version value in program/include/iniset.php, looking for anything below 1.6.20 or in the 1.7.x line below 1.7.5.1.6.20 on the 1.6 line or 1.7.5 on the 1.7 line._flag parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in _flag parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
This page as .md · .json · in your agent: get_signal("CVE-2026-114720")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.