CVE-2026-114717
Description
A flaw was found in roundcubemail. When forwarding an email as an attachment, the application uses the original message's subject line directly to construct the attachment name without properly sanitizing line breaks. A remote attacker can exploit this vulnerability by sending an email containing crafted carriage return and line feed (CRLF) characters in the subject line, allowing them to inject arbitrary Multipurpose Internet Mail Extensions (MIME) headers into outgoing forwarded messages.
Statement
A flaw was found in roundcubemail where the subject of a message forwarded as an attachment was used verbatim as the attachment name. A remote attacker could send a message with CRLF sequences in the subject, injecting arbitrary MIME part headers into the outgoing forwarded message when a user forwards it as an attachment (CVSS 4.3 MODERATE, UI:R). Fixed upstream in 1.6.20 and 1.7.5 by collapsing whitespace in the generated name.
Mitigation
update roundcubemail to 1.6.20 (1.6 LTS) or 1.7.5, or apply the upstream fix (collapsing whitespace in subject-derived attachment names); avoid forwarding untrusted messages as attachments until updated.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
