CVE-2026-114717 in Roundcube
Summary
by MITRE • 10/23/2026
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/23/2026
Roundcube Webmail versions prior to 1.6.20 and version series 1.7.x before 1.7.5 contain a critical server-side request forgery vulnerability classified under CWE-93, commonly known as CRLF injection or mail header injection. This flaw emerges specifically during the process of forwarding an email message as an attachment within the webmail interface. The underlying technical defect lies in how the application constructs the filename for the attached file; it utilizes the subject line of the original incoming message verbatim without performing adequate sanitization or encoding checks on special characters, particularly carriage return and line feed sequences.
When a user forwards a message as an attachment, Roundcube takes the raw subject string from that message and assigns it directly to the Content-Disposition header field for the new MIME part being generated in the outgoing email. Because the application fails to strip or encode newline characters present within the original subject line, an attacker who controls the content of an incoming email can inject arbitrary CRLF sequences into this filename parameter. This lack of input validation allows the injection of additional HTTP-like headers directly into the SMTP envelope or MIME structure of the forwarded message.
The operational impact of this vulnerability is significant for organizations using Roundcube as their primary mail client, particularly in environments where users frequently forward emails to external recipients. By injecting arbitrary headers, an attacker can manipulate the routing and delivery behavior of the outgoing email. Common exploitation vectors include setting a different envelope sender address to facilitate phishing campaigns that appear more legitimate by spoofing trusted domains, or modifying message priority flags to increase the likelihood of recipient engagement. In some configurations, this could also allow for header manipulation that bypasses certain spam filtering rules or alters the MIME structure in ways that might trigger security warnings on receiving mail servers while still delivering malicious content.
This vulnerability aligns with MITRE ATT&CK technique T1568.002, Dynamic Resolution, if used to redirect traffic, but more accurately maps to T1534, Internal Spearphishing, as it enables the creation of deceptive emails that appear to originate from a trusted internal source due to header manipulation. It also relates to CWE-79 in broader contexts where untrusted data is sent directly to a web user without validation, though here the target is an email client rather than a browser DOM. The vulnerability persists because the application trusts input derived from other emails as safe for use in structural components of new communications, violating the principle of least privilege and strict output encoding.
Mitigation strategies focus on immediate patching and defensive configuration updates. Administrators must upgrade Roundcube to version 1.6.20 or later, or specifically to version 1.7.5 if operating within the newer branch. The upstream fix addresses this issue by collapsing whitespace in the generated filename, effectively neutralizing CRLF sequences that rely on line breaks to inject headers. In addition to patching, organizations should enforce strict input validation policies across all web applications and consider implementing Content Security Policy (CSP) or similar controls where applicable to limit the impact of any residual injection attempts. Regular security audits focusing on email handling functions are recommended to identify similar patterns in other mail clients or custom integrations that may suffer from analogous header injection flaws.