CVE-2026-113386

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.20 Roundcube Webmail versions 1.7.x prior to 1.7.5

Description Remote authenticated attackers can perform IMAP command injection by injecting CRLF sequences into the uid parameter of the 'mail/headers' and 'mail/viewsource' endpoints. This allows the execution of arbitrary IMAP commands. CRLF refers to Carriage Return and Line Feed characters used to signify the end of a line of text.

Recommendations Update Roundcube Webmail to version 1.6.20 or later. Update Roundcube Webmail to version 1.7.5 or later. Avoid using the uid parameter in the 'mail/headers' and 'mail/viewsource' endpoints until the software is updated.