Bug 2571918 (CVE-2026-126813)
| Summary: | CVE-2026-126813 roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | Keywords: | Security |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in Roundcube Webmail. When message caching is enabled, the application fails to properly sanitize the message identifier parameter, allowing command injection into the backend Internet Message Access Protocol (IMAP) server via Carriage Return Line Feed (CRLF) sequences. A remote attacker can exploit this by tricking an authenticated user into opening a specially crafted link. Successful exploitation allows the attacker to execute arbitrary IMAP commands within the victim's session, potentially leading to unauthorized mailbox access, altered message flags, or message deletion.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2572391, 2572392 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-11-11 21:12:55 UTC
|