CVE-2026-114726
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection…
- Risk score
- 40/100
- CVSS
- 5.8 v3.1
- Exploit chance (30 days)
- 0.3%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.6.20, 1.7 or 1.7.5 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 5.8 medium
References
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
- https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Original description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.
Last activity 22 Oct 2026. Patch Forecast updates every hour.