CVE-2026-75002

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions prior to 1.6.18 Roundcube Webmail versions 1.7.x prior to 1.7.3

Description An issue exists where mail search and LITERAL+ byte-count desynchronization can occur. This condition allows for IMAP command injection, which may result in privilege escalation or information disclosure. IMAP command injection is a technique where an attacker inserts unauthorized commands into the Internet Message Access Protocol (IMAP) stream to manipulate the mail server.

Recommendations Update to version 1.6.18 or later. Update to version 1.7.3 or later.