CVE-2026-75002 in Roundcube
Summary
by MITRE • 08/17/2026
In Roundcube Webmail before 1.6.18 and 1.7.x before 1.7.3, mail search and LITERAL+ byte-count desynchronization could lead to information disclosure or privilege escalation via IMAP command injection.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified in Roundcube Webmail versions prior to 1.6.18 and the 1.7.x series before version 1.7.3 represents a critical security flaw rooted in improper input validation and state management within the application's IMAP interaction layer. Specifically, this issue manifests as a byte-count desynchronization during mail search operations that utilize the LITERAL+ extension. The LITERAL+ extension is an IMAP feature designed to allow clients to send large data literals without blocking the connection by sending the literal size first followed by the actual data. In vulnerable versions of Roundcube, the logic responsible for parsing and processing these extended literals fails to correctly synchronize the internal byte counters with the actual stream position when handling search queries. This desynchronization creates a discrepancy between what the application believes it has processed and where it actually is in the input stream, leading to unpredictable behavior during command execution.
From a technical perspective, this flaw enables IMAP command injection because an attacker can manipulate the boundaries of these literals to inject additional commands into the session. By carefully crafting requests that exploit the byte-count mismatch, an adversary can trick the Roundcube server or the underlying IMAP backend into interpreting injected data as executable IMAP commands rather than mere search parameters. This bypasses standard input sanitization measures because the injection occurs at a lower level of protocol parsing where validation is often less rigorous compared to higher-level application logic. The ability to inject arbitrary commands allows an attacker to interact directly with the mail server, potentially executing operations that should be restricted based on user privileges or session context.
The operational impact of this vulnerability is severe and multifaceted, primarily centering on information disclosure and privilege escalation. Through successful IMAP command injection, a malicious actor can retrieve sensitive email content belonging to other users if they have access to any shared folders or if the desynchronization allows them to alter search scopes beyond their authorized boundaries. Furthermore, by injecting administrative commands, an attacker could potentially escalate privileges within the Roundcube environment, gaining control over user accounts, modifying settings, or executing actions that require higher-level permissions than those held by the compromised account. This effectively undermines the confidentiality and integrity guarantees provided by the webmail interface, turning a standard email client into a vector for broader system compromise depending on how deeply the injected commands can reach within the backend infrastructure.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) as it involves the injection of malicious code or commands through improperly sanitized input data. Additionally, from an offensive security perspective such as MITRE ATT&CK, this flaw facilitates techniques related to Command and Scripting Interpreter abuse, specifically allowing for lateral movement within a mail infrastructure if multiple accounts are compromised via shared resources. The lack of strict synchronization in handling extended literals also touches upon CWE-20 Improper Input Validation, highlighting the necessity for rigorous boundary checks when processing variable-length data structures in network protocols.
To mitigate this risk, organizations running Roundcube Webmail must immediately upgrade to version 1.6.18 or later if using the stable branch, or version 1.7.3 and above for the development branch. These releases contain patches that correct the byte-count synchronization logic within the IMAP client library used by Roundcube. Until an upgrade is feasible, administrators should consider implementing strict web application firewall rules to detect and block anomalous IMAP command sequences originating from webmail sessions. Additionally, enabling comprehensive logging of IMAP commands can aid in detecting potential exploitation attempts while mitigation strategies are being deployed. It is also advisable to review access controls for shared mail folders to limit the blast radius if a single account is compromised through this vector.