CVE-2026-114716 in Roundcube
Summary
by MITRE • 10/22/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x before 1.7.5 contain a critical mail header injection vulnerability within the email sending functionality. This flaw specifically resides in the rcmail_sendmail::extract_inline_images() function, which is responsible for processing inline images embedded within emails. The core technical deficiency arises from the application's failure to validate the media type extracted directly from an inline image data URI before incorporating it into the outgoing message headers. By accepting untrusted input without rigorous sanitization or validation checks, the software allows a remote authenticated attacker to manipulate these header fields through carefully crafted payloads containing carriage return and line feed sequences.
The operational impact of this vulnerability is significant for any organization relying on Roundcube for email communications. An attacker who has obtained valid credentials can exploit this flaw to inject arbitrary MIME part headers into outgoing messages. This capability enables a range of malicious activities, including the bypassing of anti-spam filters by manipulating message structure, the injection of phishing content that appears legitimate due to trusted sender headers, and potentially the exfiltration of sensitive data if header manipulation allows for unintended routing or disclosure mechanisms. The vulnerability effectively undermines the integrity of email transmission processes managed by the application, allowing an authenticated user to compromise not only their own account but also the trustworthiness of communications sent on behalf of others within the system.
From a classification perspective, this issue aligns with CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component and is categorized under ATT&CK technique T1568.002 Dynamic Resolution: Domain Fronting or more broadly as part of email-based attacks where header manipulation facilitates further compromise. The root cause lies in the lack of input validation for media types derived from data URIs, which are often constructed by users when embedding images directly into their messages rather than uploading them via standard file upload mechanisms. This specific vector highlights the risks associated with parsing complex URI schemes without strict adherence to expected format constraints.
The upstream developers addressed this vulnerability in commit titled Fix mail header injection via media type in an inline image data URI. The remediation strategy involves implementing robust validation logic using the rcube_mime::is_mimetype_valid() function before any extracted media type is processed for inclusion in email headers. This ensures that only recognized and safe MIME types are permitted, thereby preventing the insertion of control characters like CRLF sequences that could terminate existing header lines and inject new ones. Organizations running affected versions must upgrade to Roundcube 1.6.20 or later, or version 1.7.5 and above, immediately to mitigate this risk. Additionally, implementing strict input validation policies for all user-supplied data in email clients serves as a complementary defense-in-depth measure against similar injection attacks across the application stack.