Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.20 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279Third Party AdvisoryMailing List
- https://github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047fe8e3cba81Patch
- https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b7949472Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Issue Tracking
FAQ
What is CVE-2026-114716?
CVE-2026-114716 is a vulnerability with a CVSS score of 8.5 (HIGH). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image dat...
How severe is CVE-2026-114716?
CVE-2026-114716 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114716?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.