Roundcube Webmail: 20 Vulnerabilities Disclosed, Including Command Injection and SSRF Flaws
A batch of 20 vulnerabilities, including High-severity flaws like IMAP command injection and SSRF bypass, were disclosed for Roundcube Webmail, impacting versions prior to 1.6.20 and 1.7.5.
Key findings
- 20 vulnerabilities disclosed for Roundcube Webmail, affecting versions prior to 1.6.20 and 1.7.5.
- High-severity flaws include IMAP command injection, SSRF bypass, and mail header injection.
- Vulnerabilities span improper authentication, authorization, and content blocking bypasses.
- All issues addressed in Roundcube Webmail 1.6.20 and 1.7.5; users urged to update.
On October 22, 2026, a significant batch of 20 vulnerabilities was disclosed for Roundcube Webmail, affecting versions prior to 1.6.20 and 1.7.x before 1.7.5. These vulnerabilities, spanning a range of severities from Low to High, were reported together, highlighting potential security weaknesses in the widely used webmail client. The disclosures were made over a two-day period, from October 20th to October 22nd, 2026.
Several vulnerabilities revolve around mail header injection and command injection. CVE-2026-114713 and CVE-2026-113386, both rated High, involve IMAP command injection. Attackers can inject CRLF sequences into parameters like _flag or _uid in various actions (e.g., mail/mark, mail/headers, mail/viewsource) to execute arbitrary IMAP commands. Another High-severity vulnerability, CVE-2026-114716, also involves mail header injection, stemming from the unchecked media type of inline image data URIs, allowing attackers to inject arbitrary MIME part headers. CVE-2026-114726 and CVE-2026-114725 present further mail header injection risks due to improper handling of control characters and unsanitized header values, respectively.
Security concerns also extend to improper authentication and authorization. CVE-2026-114732 (Medium) describes an improper authentication flaw in multi-host installations where user logins could be resolved incorrectly when using alias addresses. Similarly, CVE-2026-114718 (Medium) details an incorrect authorization vulnerability in the Modoboa password driver, where the first account search result was used instead of matching the authenticated user, potentially allowing unauthorized password changes.
Several vulnerabilities relate to bypassing security filters and content blocking. CVE-2026-114730 (High) is a server-side request forgery (SSRF) filter bypass due to an incomplete network blocklist. CVE-2026-114729 and CVE-2026-114727 highlight remote content blocking bypasses, with the former affecting SVG SMIL animation attributes and the latter involving unsafe content passed to ImageMagick for image resizing, potentially leading to the loading of external resources or execution of commands. CVE-2026-114722 (Medium) involves a CSS scoping bypass in HTML messages, allowing selectors to remain unscoped.
Other issues include uncontrolled resource consumption (CVE-2026-114731, Medium), object injection (CVE-2026-114724, High), cross-site scripting (CVE-2026-114715, Medium), and path traversal (CVE-2026-114714, Medium). Low-severity issues include a disabled actions configuration bypass (CVE-2026-114721) and bypasses of ImageMagick resource limits during thumbnail generation (CVE-2026-114723).
All disclosed vulnerabilities have been addressed in Roundcube Webmail versions 1.6.20 and 1.7.5. Users are strongly advised to update to these patched versions to mitigate the risks associated with these security flaws. The comprehensive nature of this batch underscores the importance of timely patching for webmail systems.
The batch of vulnerabilities was disclosed on October 22, 2026, affecting Roundcube Webmail versions prior to 1.6.20 and 1.7.5. The vulnerabilities span a range of severities, with several High-rated flaws including IMAP command injection (CVE-2026-114713, CVE-2026-113386), SSRF filter bypass (CVE-2026-114730), and mail header injection via image data URIs (CVE-2026-114716). Other critical issues include object injection (CVE-2026-114724) and vulnerabilities related to improper authentication and authorization.
Roundcube Webmail versions 1.6.20 and 1.7.5 contain fixes for all disclosed vulnerabilities. Users are urged to update immediately to secure their webmail installations. The timely patching of these issues is crucial for maintaining the security and integrity of email communications.