Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-114717

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection…

Risk score
41/100
CVSS
5.8 v3.1
Exploit chance (30 days)
0.4%
Published
22 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbi…
Affected
Roundcube Webmail before 1.6.20, 1.7, 1.7.5
Fix
Upgrade Roundcube Webmail to 1.6.20, 1.7 or 1.7.5 (whichever matches your release line), or later.
Exploitation
No known exploitation

Story map

Story map: Roundcube WebmailTHE FLAWSTHE FIXCVE-2026-114717Roundcube Webmail before1.6.20 and 1.7.x before 1.7.5 isaffected by a mail header…CVSS 5.8 · EPSS 0%CVE-2026-114724Unsafe deserialisationCVSS 8.1 · EPSS 0%CVE-2026-114716Roundcube Webmail before1.6.20 and 1.7.x before 1.7.5 isaffected by a mail header…CVSS 8.5 · EPSS 0%CVE-2026-114727Roundcube Webmail before1.6.20 and 1.7.x before 1.7.5passes potentially unsafe…CVSS 8.3 · EPSS 0%Upgrade Roundcube Webmail1.6.20 · 1.7 · 1.7.5or later on your release lineWho is exposedRoundcube Webmail before1.6.20, 1.7, 1.7.5AMBER · PATCH THIS WEEKRoundcubeWebmailRoundcube Webmail before 1.6.20and 1.7.x before 1.7.5 contains anobject injection primitive inrcube_session::unserialize(). Asession key prefixed with “!”was treated as having no value,and the reconstructed…Where it standsNo known exploitationCONNECTS TOSame weaknessCWE-99 (CWE-99)3 other warnings in 30 days →Same productEarlier Roundcube Webmail warnings8 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Roundcube Webmail: Amber, patch this week. Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in rcube_session::unserialize(). A session key prefixed with “!” was treated as having no value, and the reconstructed serialized string was emitted with a key but no corresponding value, desynchronizing the remainder of the …

The flaws

  • CVE-2026-114717: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection… (CVSS 5.8 · EPSS 0%)
  • CVE-2026-114724: Unsafe deserialisation (CVSS 8.1 · EPSS 0%)
  • CVE-2026-114716: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection… (CVSS 8.5 · EPSS 0%)
  • CVE-2026-114727: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into… (CVSS 8.3 · EPSS 0%)

The fix

Upgrade Roundcube Webmail: 1.6.20 · 1.7 · 1.7.5 or later on your release line

Who is exposed: Roundcube Webmail before 1.6.20, 1.7, 1.7.5

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 5.8 medium

References

Original description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.

Last activity 22 Oct 2026. Patch Forecast updates every hour.