Command injection in Roundcube Webmail - #VU156137
Published: October 19, 2026
Vulnerability identifier: #VU156137
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject IMAP commands into mailbox operations.
The vulnerability exists due to improper neutralization of CRLF sequences in the _uid parameter of the mail/headers and mail/viewsource actions when constructing IMAP commands. A remote user can supply a crafted _uid value containing carriage returns and line feeds to introduce additional IMAP commands that may perform unauthorized mailbox operations.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5