UpHeron
All vulnerabilities

Servers and applications

CVE-2026-114720

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which…

Severity
High 7.1
Published
22 Oct 2026
Last changed
30 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
1.6.20, 1.7.5
Sources
NVD

Affected software

SoftwareAffected versions
RoundcubeServers and applications · cpe:a:roundcube:webmail
  • From 1.6.0 before 1.6.20
  • From 1.7.0 before 1.7.5

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-114720
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-114720