---
id: CVE-2026-114726
title: >-
  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail
  header injection vulnerability in the Bounce (resend) action
summary: >-
  Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail
  header injection vulnerability in the Bounce (resend) action.
  rcube_mime::decode_address_list() did not strip control characters from the
  decoded display name, …
severity: medium
cvss: 5.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-99
vendor: Roundcube
product: Webmail
affected:
  - Webmail >= 1.6.0 < 1.6.20
  - Webmail >= 1.7.0 < 1.7.5
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T01:55:25.693Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-114726'
references:
  - url: 'https://bugs.debian.org/1151279'
  - url: >-
      https://github.com/roundcube/roundcubemail/commit/d3a35545fdaf72b02a9a4d670064895488e9d9d0
  - url: 'https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5'
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.7.5'
  - url: 'https://github.com/roundcube/roundcubemail/releases/tag/1.6.20'
  - url: >-
      https://github.com/roundcube/roundcubemail/commit/3a136465c965776a5f636587187626985dae4f3b
tags:
  - cve.org
ingestedAt: '2026-10-22T02:23:25.179Z'
---

## Overview

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the Bounce (resend) action. rcube_mime::decode_address_list() did not strip control characters from the decoded display name, so a received message whose From display-name carries CRLF sequences in an encoded word could inject arbitrary headers into the message emitted when the user bounces it. Upstream fixed this in the commit “Fix mail header injection via the From display-name in the Bounce (resend) action”.

## Affected

- `Webmail >= 1.6.0 < 1.6.20`
- `Webmail >= 1.7.0 < 1.7.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.