CVE-2026-114726
Description
A flaw was found in Roundcube Webmail. This vulnerability allows a remote attacker to inject arbitrary email headers by sending an email containing encoded carriage return and line feed (CRLF) control characters within the sender display name. When an affected user bounces or resends the message, the application fails to strip these control characters, causing injected headers to be included in the outgoing email and potentially enabling email spoofing or unintended message routing.
Statement
Roundcube Webmail did not strip control characters from the decoded From display-name in rcube_mime::decode_address_list(). A remote attacker could send a message with encoded CRLF in the sender display name; when a user bounces (resends) it, arbitrary headers could be injected into the outgoing message, potentially enabling email spoofing or unintended message routing. Fixed in 1.6.20 and 1.7.5.
Mitigation
Update to roundcubemail 1.6.20 or 1.7.5. As a workaround, avoid using the Bounce (resend) action on untrusted messages until updated.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
