CVE-2026-114725Medium· 5.0▾ SunlitRoundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken fr…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail stripped newline characters only from the Subject and Organization headers, leaving other header values taken from request parameters unsanitized, so a remote authenticated attacker could inject arbitrary headers into an outgoing message via the References, In-Reply-To, Message-ID and From parameters. Upstream fixed this in the commit “Fix mail header injection via References/In-Reply-To/Message-ID/From parameters”, which normalizes whitespace in every string header value.
Webmail >= 1.6.0 < 1.6.20Webmail >= 1.7.0 < 1.7.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114717Medium· 4.0Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment
CVE-2026-114716High· 8.5Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability
CVE-2026-114726Medium· 5.8Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action
CVE-2026-114730High· 7.2Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass
CVE-2026-114729Medium· 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass
CVE-2026-114731Medium· 5.3Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability in the CSS proxy (the utils/modcss action)