Live › vulnerability › CVE-2026-114725
Go to dashboardRoundcube Webmail does not strip newlines from the References, In-Reply-To, Message-ID and From fields when sending mail, so a logged-in user can inject extra headers into outgoing messages. The attacker gets to shape the headers of mail sent through the server, which can be used to spoof or manipulate messages.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Any Roundcube Webmail installation on the affected 1.6 or 1.7 branches is exposed, since the flaw sits in the shared send path used by every user. The attacker needs a valid mail account on that Roundcube instance, so public-facing installs with open or self-registration are the most at risk. Installs that are already on the fixed versions can skip it.
No product ranges from the sources yet.
grep -i "RCMAIL_VERSION" program/include/iniset.php in the Roundcube install directory1.6.x below 1.6.20 or any 1.7.x below 1.7.5 is exposed1.6.20 on the 1.6 branch or 1.7.5 on the 1.7 branchEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.
This page as .md · .json · in your agent: get_signal("CVE-2026-114725")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.