CRLF injection in Roundcube Webmail - #VU156145
Published: October 19, 2026
Vulnerability identifier: #VU156145
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-93
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject mail headers and alter outgoing message headers.
The vulnerability exists due to improper neutralization of header delimiters in mail header construction when processing References, In-Reply-To, Message-ID, or From parameters. A remote user can submit crafted values in these parameters to introduce additional headers or alter the interpretation of existing headers.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5