Improper Neutralization of Special Elements in Output Used by a Downstream Component in Roundcube Webmail - #VU162690
Published: November 9, 2026
Vulnerability identifier: #VU162690
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inject unintended content into outbound HTTP requests.
The vulnerability exists due to insufficient neutralization of HTTP request syntax in Roundcube Webmail's spellcheck ATD backend when constructing spellcheck requests. A remote user can submit crafted spellcheck input to alter the HTTP request sent by the backend.
Affected software
Roundcube Webmail
Remediation
Install security update from vendor's website.
Roundcube Webmail - addressed in versions 1.6.21, 1.7.6