UpHeron
All vulnerabilities

Servers and applications

CVE-2026-113386

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

Severity
High 7.1
Published
20 Oct 2026
Last changed
22 Oct 2026
Added to UpHeron
3 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
CVE Program

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cna:roundcube|webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-113386