CVE-2026-114720
HIGH
NVD
CVSS Score
7.1
Severity
HIGH
Published
Oct 22, 2026
Vendor
unknown
Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
References
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261e71f8d11f9b
- https://github.com/roundcube/roundcubemail/commit/6c3c1897c11e193e47fccaabc87e9ca2a0a73e51
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5