CVE-2026-113386

7.1High

Published 20 Oct 2026 · NVD status: Received · AI triage by gemini-3.8-flash

7.1High

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None
Impact: High impact on integrity
Weakness: CWE-93

Impact

Authenticated attackers can run arbitrary IMAP commands on the backend mail server. They need valid user credentials to log into Roundcube Webmail first.

Root cause

Improper sanitization allows CRLF sequence injection inside the _uid parameter of the mail/headers and mail/viewsource actions.

Affected systems

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Fix & remediation

Upgrade Roundcube Webmail to version 1.6.20 or 1.7.5. No specific configuration workaround is provided; prioritize updating the application.

shell

$ sudo apt-get update && sudo apt-get install --only-upgrade roundcube-core

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-113386