CVE-2026-114720
Description
A flaw was found in roundcubemail. This vulnerability allows a remote authenticated attacker to execute arbitrary Internet Message Access Protocol (IMAP) commands on the connected mail server. The issue exists due to insufficient input validation, which permits the injection of carriage return line feed (CRLF) sequences into the _flag parameter of the mail mark action. As a result, an attacker can tamper with mailbox data or execute unauthorized server commands within their active session.
Statement
This vulnerability is rated as an Important security flaw because an authenticated user can inject arbitrary protocol commands into the backend IMAP stream, threatening the integrity and confidentiality of mailbox contents. The roundcubemail package is maintained in community repositories, such as Fedora and Extra Packages for Enterprise Linux (EPEL), and is not distributed or supported as part of Red Hat Enterprise Linux core offerings. Exploitation is constrained by requiring valid user credentials on the webmail service, restricting unauthorized activity to privileges granted to the authenticated session.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
