CRLF injection in Roundcube Webmail - #VU124138
Published: March 19, 2026 / Updated: March 19, 2026
Vulnerability identifier: #VU124138
CSH Severity: Medium
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N]
CVE-ID: N/A
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform IMAP command injection and bypass CSRF protections.
The vulnerability exists due to improper input validation in mail search functionality when handling search queries. A remote user can send a specially crafted search request containing malicious IMAP commands to execute arbitrary commands on the IMAP server and bypass CSRF restrictions.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.5.14, 1.6.14