Roundcube Webmail CVE-2026-113386

Requires an authenticated Roundcube session (valid webmail login, per CVSS PR:L) on an unpatched instance running a version before 1.6.20 or a 1.7.x before 1.7.5. The attacker must reach the mail/headers or mail/viewsource action and supply a _uid parameter containing raw CR/LF (\r\n) characters; no non-default configuration is needed - default installations in the affected version range are vulnerable. The primary limiting factor is the authentication requirement (no unauthenticated path) and the bound of injected IMAP commands to the attacker's own authenticated IMAP session; no user interaction by a victim is required (UI:N).

This is a moderate-priority, authentication-gated vulnerability rather than a critical internet-wide threat. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms network reachability and low attack complexity but REQUIRES at least low-level privileges (PR:L) - i.e. a valid authenticated Roundcube webmail account - which substantially narrows the attacker population to insiders, phished/credential-stuffed users, or multi-tenant hosting neighbors. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The CVE is NOT present in CISA KEV and no public exploit code is referenced, so there is no public exploit identified at time of analysis. The impact profile (C:L/I:H/A:N) reflects that injected IMAP commands run within the attacker's own authenticated mail session, enabling manipulation of mailbox state (high integrity impact) with limited confidentiality exposure and no availability impact. The CWE-93 (CRLF injection) classification and the source-code fix (adding preg_match('/[\r\n]/', $uid) rejection in mail/headers.php and mail/viewsource.php) independently corroborate the described mechanism. Overall: a genuine, vendor-confirmed and patched flaw worth prompt remediation on exposed webmail, but not an emergency given the authentication requirement and absence of KEV/POC signals.

An attacker who already holds valid Roundcube webmail credentials (their own account, or stolen/phished ones) sends a crafted request to the mail/headers or mail/viewsource action with CRLF sequences embedded in the _uid parameter. The injected newlines break out of the intended IMAP command and let the attacker smuggle arbitrary IMAP commands into the server session, manipulating mailbox operations. No public exploit code is identified at time of analysis, and the attack requires an authenticated session (CVSS PR:L).