CVE-2026-113386 in Roundcube
Summary
by MITRE • 10/20/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x before 1.7.5 represents a critical security flaw classified as an IMAP command injection, which aligns with the Common Weakness Enumeration identifier CWE-94 for Improper Control of Generation of Code or Commands often referred to as Injection. This specific vulnerability arises from insufficient sanitization and validation mechanisms within the application's handling of user-supplied input parameters, specifically targeting the _uid parameter utilized during mail header retrieval and source viewing operations. The core technical failure lies in the application's inability to properly distinguish between legitimate data values and malicious command sequences, allowing an attacker to inject Carriage Return Line Feed (CRLF) characters into these parameters. This lack of strict boundary checking enables the manipulation of underlying IMAP protocol interactions that Roundcube uses to communicate with mail servers.
From a technical perspective, the exploitation vector involves remote authenticated attackers who have valid credentials for the webmail interface but do not necessarily require administrative privileges. By injecting CRLF sequences into the _uid parameter associated with the mail/headers and mail/viewsource actions, an attacker can break out of the intended context of the IMAP command being executed. This injection allows the insertion of additional, arbitrary IMAP commands that are then processed by the backend mail server as if they were legitimate requests originating from Roundcube itself. The CRLF characters serve to terminate the original command and initiate a new one, effectively bypassing any logical separation between data input and executable instructions within the protocol layer.
The operational impact of this vulnerability is severe due to its potential for unauthorized access and data exfiltration. Once an attacker successfully injects arbitrary IMAP commands, they can interact directly with the mail server using the privileges associated with the compromised user account. This capability allows for a wide range of malicious activities including but not limited to reading sensitive emails from other folders without proper authorization checks, deleting messages to disrupt service or cover tracks, copying messages to exfiltrate data, and potentially modifying message flags such as read/unread status. In environments where IMAP servers are configured with broader permissions or where shared mailboxes exist, the scope of damage could extend beyond individual user accounts to affect organizational communication integrity.
This vulnerability maps directly to several entries in the MITRE ATT&CK framework, particularly those related to Collection and Exfiltration over Application Layer Protocol. The technique mirrors T1059 Command and Scripting Interpreter behaviors where an attacker leverages a trusted application to execute commands on behalf of another system component. Furthermore, it relates to data access patterns described under techniques involving indirect command execution through vulnerable applications that act as intermediaries between users and backend services like mail servers.
Mitigation strategies must prioritize immediate software updates to the patched versions 1.6.20 or later for the stable branch and 1.7.5 or later for the development branch, which include rigorous input validation fixes. In scenarios where patching is not immediately feasible, network-level controls such as web application firewalls can be configured to detect and block HTTP requests containing CRLF sequences within query parameters associated with mail operations. Additionally, implementing strict output encoding and ensuring that all user inputs are validated against a whitelist of expected characters for the _uid parameter can provide defense-in-depth measures. Regular security audits focusing on input validation across all webmail endpoints are recommended to prevent similar injection flaws in other modules of the application.