Skip to content
CVE PROGRAM SOURCE RECORD5.0 Medium

CVE-2026-114725

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and O

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
mitre

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Roundcube Webmail

Default version status: unaffected

  • 1.6.0 to < 1.6.20affected
  • 1.7.0 to < 1.7.5affected

References