Live › vulnerability › CVE-2026-114726
Go to dashboardRoundcube Webmail fails to strip control characters from a decoded From display name when a user bounces a message. A received message with CRLF sequences in an encoded word can inject arbitrary headers into the bounced mail.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running self-hosted Roundcube Webmail before 1.6.20 or 1.7.x before 1.7.5 are exposed when users bounce incoming messages. An attacker must send a crafted message with an encoded From display name, so the risk depends on mail reaching users who use bounce. Hosts on managed webmail services or on patched versions can skip it.
No product ranges from the sources yet.
grep -r "RCMAIL_VERSION" program/include/iniset.php in the Roundcube install directory1.6.20 or later on the 1.6 line, or to 1.7.5 or later on the 1.7 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
This page as .md · .json · in your agent: get_signal("CVE-2026-114726")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.