CVE-2026-113386 PUBLISHED

Assigner: mitre
Reserved: 20.10.2026 Published: 20.10.2026 Updated: 20.10.2026

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
CVSS Score: 7.1

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	Low
Privileges Required	Low	Integrity Impact	High
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	Roundcube
Product	Webmail
Versions	Default: unaffected affected from 1.6.0 to 1.6.20 (excl.) affected from 1.7.0 to 1.7.5 (excl.)

References

https://bugs.debian.org/1151279
https://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a
https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
https://github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049

Problem Types

CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') CWE