Description
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
Affected products
roundcube: webmail
References6
- github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047f… Patch
- github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c16… Patch
- bugs.debian.org/1151279 Third Party AdvisoryMailing List
- github.com/roundcube/roundcubemail/releases/tag/1.6.20 Release Notes
- github.com/roundcube/roundcubemail/releases/tag/1.7.5 Release Notes
- roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5 Issue Tracking
Metrics
- CVSS 3.1
-
8.5
HIGH
Score source: CNA
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N - EPSS — exploit probability
- 0% percentile: 38 · as of 8 November 2026
- CWE
- CWE-99
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.