Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
CVE-2026-114726
CVSS base score
5.8 (v3.1)
Severity
MEDIUM
Attack vector
Network
Weakness
CWE-99
Last modified
October 29, 2026
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Affected products
roundcube webmail
References
- bugs.debian.org Third Party Advisory, Mailing List
- github.com Patch
- github.com Patch
- github.com Release Notes
- github.com Release Notes
- roundcube.net Issue Tracking