CVE-2026-114716
HIGH
8,5
Source: [email protected]
Attack Vector: network
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: changed
Confidentiality: low
Integrity: high
Availability: none
Description
AI Translation Available
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
99
Improper Control of Resource Identifiers ('Resource Injection')
DraftCommon Consequences
Security Scopes Affected:
Confidentiality
Integrity
Potential Impacts:
Read Application Data
Modify Application Data
Read Files Or Directories
Modify Files Or Directories
Applicable Platforms
All platforms may be affected
https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047fe8e3cba8…
https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b794947…
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5