Bug 2558661 (CVE-2026-114720)

Summary: CVE-2026-114720 roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection in the _flag parameter
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in roundcubemail. This vulnerability allows a remote authenticated attacker to execute arbitrary Internet Message Access Protocol (IMAP) commands on the connected mail server. The issue exists due to insufficient input validation, which permits the injection of carriage return line feed (CRLF) sequences into the `_flag` parameter of the mail mark action. As a result, an attacker can tamper with mailbox data or execute unauthorized server commands within their active session.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2558886, 2558890    
Bug Blocks:    

Description OSIDB Bzimport 2026-10-22 01:43:49 UTC 
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability. A remote authenticated attacker can exploit this via CRLF sequences injected into the _flag parameter of the mail/mark action to execute arbitrary IMAP commands. Upstream fixed this in the commit “Fix IMAP command injection via CRLF in `_flag` parameter of mail/mark action”, which rejects flags containing control, whitespace and IMAP-special characters.