CVE-2026-126813

Description

A flaw was found in Roundcube Webmail. When message caching is enabled, the application fails to properly sanitize the message identifier parameter, allowing command injection into the backend Internet Message Access Protocol (IMAP) server via Carriage Return Line Feed (CRLF) sequences. A remote attacker can exploit this by tricking an authenticated user into opening a specially crafted link. Successful exploitation allows the attacker to execute arbitrary IMAP commands within the victim's session, potentially leading to unauthorized mailbox access, altered message flags, or message deletion.

Statement

This vulnerability is rated as having Moderate impact because exploitation requires social engineering against an authenticated user and relies on the message caching feature being activated. An attacker must induce an active webmail user to follow a crafted URL, injecting unauthorized protocol commands into the backend IMAP connection. While successful attacks can modify message states or alter mailbox permissions within the victim's session, they do not grant direct underlying system access.

Mitigation

Disable message caching in the Roundcube configuration to prevent processing CRLF sequences through the cached message workflow.

1. Edit the Roundcube configuration file (typically `/etc/roundcubemail/config.inc.php`) and ensure message caching is disabled:

php
$config['messages_cache'] = false;

2. Reload the web server or PHP process manager for changes to take effect:

bash
systemctl reload php-fpm
or
bash
systemctl reload httpd

Caveats: Disabling message caching causes Roundcube to query the IMAP server directly for message contents and structure, which can increase IMAP server workload and introduce slight latency during message browsing. Reloading web services may temporarily disrupt active client sessions.

Understanding the Weakness (CWE)

CWE-93

Integrity

Technical Impact: Modify Application Data

Frequently Asked Questions

Not sure what something means? Check out our Security Glossary.

Want to get errata notifications? Sign up here.