Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.0
CVE-2026-114717: Roundcube Webmail can attach malicious headers when forwarding
CVE-2026-114717 · published 14 days ago
Summary
Versions of Roundcube Webmail before 1.6.20 and before 1.7.5 let a crafted email subject become the file name of a forwarded attachment. This lets attackers add extra mail headers, potentially altering how the message is processed or delivered. Upgrade to the latest Roundcube release or apply the vendor's patch that sanitizes the subject before using it as the attachment name.
What to do
- Update debian roundcube to version 1.6.20+dfsg-1.
- Update debian roundcube to version 1.6.20+dfsg-0+deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | roundcube | webmail |
< 1.6.20 >= 1.6.0, < 1.6.20 >= 1.7.0, < 1.7.5 |
| Debian:12 | debian | roundcube | All versions |
| Debian:14 | debian | roundcube |
< 1.6.20+dfsg-1 Fix: upgrade to 1.6.20+dfsg-1
|
| Debian:13 | debian | roundcube |
< 1.6.20+dfsg-0+deb13u1 Fix: upgrade to 1.6.20+dfsg-0+deb13u1
|
| Ubuntu:Pro:16.04:LTS | canonical | roundcube | All versions |
Original advisory text
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was us...
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a message is forwarded as an attachment. The subject of the forwarded message was used verbatim to generate the attachment name, so a received message whose subject contains CRLF sequences could inject arbitrary MIME part headers into the outgoing message. Upstream fixed this in the commit “Fix mail header injection via subject of a message forwarded as attachment”, which collapses whitespace in the generated name.
References
- https://bugs.debian.org/1151279 Third Party Advisory
- https://github.com/roundcube/roundcubemail/commit/4c3291ce9df9e1d3b45330d0854d65... Patch
- https://github.com/roundcube/roundcubemail/commit/c325953a251d0132f1909569b3eac0... Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20 Patch
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5 Patch
- https://security-tracker.debian.org/tracker/CVE-2026-114717 Vendor Advisory
- https://github.com/roundcube/roundcubemail/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-1147... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-114717 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-114717 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-114717 Third Party Advisory
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-99Improper Control of Resource Identifiers ('Resource Injection')
Timeline
Published22 Oct 2026
Updated4 Nov 2026
First seen22 Oct 2026
Sources
CVE-2026-114717 · NVD
CVE-2026-114717 · MITRE
DEBIAN-CVE-2026-114717 · OSV
CVE-2026-114717 · OSV
UBUNTU-CVE-2026-114717 · OSV
Track software like this
Free during beta