Vulnerability Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Roundcube | Webmail | >= 1.6.0, < 1.6.20 |
Related Weaknesses (CWE)
References
- https://bugs.debian.org/1151279Third Party AdvisoryMailing List
- https://github.com/roundcube/roundcubemail/commit/242c6d6a150c850bd96d20d400261ePatch
- https://github.com/roundcube/roundcubemail/commit/6c3c1897c11e193e47fccaabc87e9cPatch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20Release Notes
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5Release Notes
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5Issue Tracking
FAQ
What is CVE-2026-114720?
CVE-2026-114720 is a vulnerability with a CVSS score of 7.1 (HIGH). Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _fl...
How severe is CVE-2026-114720?
CVE-2026-114720 has been rated HIGH with a CVSS base score of 7.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114720?
Check the references section above for vendor advisories and patch information. Affected products include: Roundcube Webmail.