Bug 2571918 (CVE-2026-126813) - CVE-2026-126813 roundcubemail: roundcubemail: Arbitrary IMAP command execution via CRLF injection
Summary: CVE-2026-126813 roundcubemail: roundcubemail: Arbitrary IMAP command executio...
Keywords:
Status: NEW
Alias: CVE-2026-126813
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2572391 2572392
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-11-11 21:12 UTC by OSIDB Bzimport
Modified: 2026-11-12 13:34 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-11-11 21:12:55 UTC 
Roundcube Webmail before 1.6.21 and 1.7.x before 1.7.6 contains an IMAP command injection vulnerability that allows attackers to inject commands via CRLF in the _uid parameter when messages_cache is enabled. Attackers can lure logged-in victims into opening crafted GET links to mail/show or mail/get, executing IMAP commands that delete messages, change flags, or grant mailbox access via SETACL.
Note You need to log in before you can comment on or make changes to this bug.