Roundcube Webmail Header Injection Flaw CVE-2026-114716 Rated High

Roundcube Webmail contains a high-severity mail header injection vulnerability that allows authenticated attackers to inject arbitrary MIME part headers. The flaw exists in versions prior to 1.6.20 and 1.7.5, where insufficient validation of inline image data enables malicious header insertion.

What happened

The vulnerability, tracked as CVE-2026-114716, was assigned a CVSS score of 8.5, which the National Vulnerability Database classifies as high severity. According to the NVD record, the issue stems from how the `rcmail_sendmail::extract_inline_images()` function processes media types derived from inline image data URIs. The function failed to validate the media type string before incorporating it into the email composition process.

This lack of validation creates an attack vector for remote authenticated users. An attacker with valid login credentials can craft a malicious inline image data URI containing CRLF (carriage return line feed) sequences within the media type field. When the application processes this data, it interprets the CRLF sequences as header delimiters, allowing the injection of arbitrary MIME part headers into the resulting outgoing message.

The upstream development team addressed this issue by implementing stricter validation logic. The fix involves using the `rcube_mime::is_mimetype_valid()` function to verify the media type before processing. This commit, titled “Fix mail header injection via media type in an inline image data URI,” ensures that only valid media types are accepted, thereby neutralizing the injection vector.

Why it matters

This flaw exposes organizations running unpatched Roundcube Webmail installations to potential email manipulation attacks. Because the vulnerability requires authentication, attackers must first compromise a user account or obtain valid credentials through other means. Once authenticated, they can inject arbitrary MIME part headers into outgoing messages, which may compromise email integrity and trust.

The high CVSS score reflects the severity of the vulnerability as rated by the National Vulnerability Database. Since Roundcube Webmail is widely deployed in enterprise and organizational environments, the potential impact is significant. Attackers could use injected headers to alter message metadata in ways that compromise email integrity.

Security teams must prioritize patching to mitigate this risk. The availability of upstream fixes for versions 1.6.20 and 1.7.5 provides a clear remediation path. Organizations should verify their current versions and apply updates immediately to close this exposure. Delaying patching leaves systems vulnerable to abuse by any actor who gains access to legitimate user accounts.

Our take on the response

• Verify current Roundcube Webmail version against the affected ranges.
• Apply patches to version 1.6.20 or 1.7.5 as soon as possible.
• Monitor for unauthorized changes to email headers in outbound traffic.
• Review authentication logs for suspicious login activity leading up to exploitation.

What defenders should look for

Teams usually detect header injection by monitoring for anomalous MIME structures in outbound email logs. Check whether outgoing messages contain unexpected header fields or unusual formatting that deviates from standard patterns. Look for spikes in email activity from authenticated accounts that typically send few messages. Review application logs for errors related to media type processing or inline image handling. Containment moves should include disabling compromised accounts and temporarily restricting outbound email capabilities for affected users while investigating the scope of the breach.

What to do and how to stay safe: Roundcube Webmail

• Audit all Roundcube Webmail installations to identify versions prior to 1.6.20 and 1.7.5.
• Apply the latest security updates provided by the vendor to patch the header injection flaw.
• Monitor authentication logs for unusual login patterns that may indicate compromised credentials.
• Implement strict input validation on all web applications that process user-supplied media data.

Step-by-step guide: Vulnerability Management Myths That Waste Your Time and Budget

General security guidance from the NetSec Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Roundcube Webmail are affected by CVE-2026-114716?

Versions before 1.6.20 and 1.7.x before 1.7.5 are affected by this vulnerability.

Is a patch available for this vulnerability?

Yes, upstream developers have released fixes in versions 1.6.20 and 1.7.5.

What type of access does an attacker need to exploit this flaw?

A remote authenticated attacker needs valid login credentials to exploit this vulnerability.