CVE-2026-113386
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of t
Roundcube WebmailApplications & CMS
CVSS
7.1HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.97%Chance of exploitation activity in the next 30 days, higher than 61% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
Text from CVE List
Affected versions 2
- Webmailaffected: 1.6.0 before 1.6.20CVE List
- Webmailaffected: 1.7.0 before 1.7.5CVE List
References 7
- github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9aFixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.7.5Fixvia CVE List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20Fixvia CVE List
- github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447Fixvia CVE List
- github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049Fixvia CVE List
- bugs.debian.org/1151279Advisoryvia CVE List
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Advisoryvia CVE List