Executive Summary
A vulnerability in Roundcube Webmail, tracked as CVE-2026-114716, allows remote authenticated attackers to inject arbitrary MIME part headers into outgoing messages. This vulnerability affects Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5, with a CVSS score of 8.5, indicating high severity.
Technical Analysis
The vulnerability is caused by the `rcmail_sendmail::extract_inline_images()` function using the media type taken from an inline image data URI without validating it. This allows a remote authenticated attacker to inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. The vulnerability is classified as CWE-99.
How It Gets Exploited
An attacker with a remote authenticated session on the Roundcube Webmail platform can exploit this vulnerability. The attacker would send a crafted inline image data URI with a media type containing CRLF sequences to the `rcmail_sendmail::extract_inline_images()` function. When the function processes this input, it fails to validate the media type, allowing the attacker to inject arbitrary MIME part headers into the outgoing message. This could lead to integrity impacts, such as adding malicious headers or modifying the message content.
Impact Assessment
The vulnerability affects Roundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5. According to the CVSS score of 8.5, the impact is high, with confidentiality impact being low, integrity impact being high, and availability impact being none. An attacker could achieve integrity impacts, such as modifying message content or adding malicious headers.
Recommended Actions
To mitigate this vulnerability, users should update Roundcube Webmail to version 1.6.20 or later, or 1.7.5 or later. Additionally, users can implement input validation and sanitization for media types in inline image data URIs to prevent similar vulnerabilities.
Sources
- National Vulnerability Database (NVD)
- Roundcube Webmail GitHub repository
- Debian bug report