Aller au contenu
en Se connecter
7.1 Élevée

CVE-2026-114720 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability

Description

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.

Produits et versions touchés

Produit Versions touchées Corrigé en
Webmail 1.7 1.7.0 → < 1.7.5 1.7.5
Webmail 1.6 1.6.0 → < 1.6.20 1.6.20

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Webmail

Les 62 CVE de Webmail →
CVE-2026-114732 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in… 6.8 Moyenne CVE-2026-114731 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption vulnerability… 5.3 Moyenne CVE-2026-114730 Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass 7.2 Élevée CVE-2026-114729 Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass 5.3 Moyenne
Suivre cette CVE