Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
CVE-2026-114720
CVSS base score
7.1 (v3.1)
Severity
HIGH
Attack vector
Network
Weakness
CWE-93
Last modified
October 30, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Affected products
roundcube webmail
References
- bugs.debian.org Third Party Advisory, Mailing List
- github.com Patch
- github.com Patch
- github.com Release Notes
- github.com Release Notes
- roundcube.net Issue Tracking