Command injection in Roundcube Webmail - #VU156150
Published: October 19, 2026
Vulnerability identifier: #VU156150
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject IMAP commands into mailbox operations.
The vulnerability exists due to improper neutralization of CRLF sequences in the _flag parameter of the mail/mark action when constructing IMAP commands. A remote user can submit a crafted _flag value containing carriage returns and line feeds to introduce additional IMAP commands that may perform unauthorized mailbox operations.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.20, 1.7.5