Roundcube Webmail CVE-2026-114716

Exploitation requires an authenticated Roundcube account (PR:L - any valid, even low-privilege mailbox user) and use of the standard HTML compose feature with an inline image supplied as a data URI; the attacker must control the media-type portion of that data URI and insert CRLF sequences into it, which the vulnerable extract_inline_images() passed through unvalidated. No special non-default configuration is required - inline-image handling on message send is core functionality - and no victim interaction is needed. The principal limiting factor is the authentication requirement: the attacker must already possess valid webmail credentials, so this is not exploitable by fully anonymous remote attackers. Affected deployments are Roundcube before 1.6.20 and 1.7.x before 1.7.5; patched versions reject invalid media types.

This is a credible, above-average-priority issue for organizations running Roundcube, but not an emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N, 8.5 High) is internally consistent with the description: network-reachable, low-complexity, requires an authenticated low-privilege user (PR:L = any valid mailbox account), no victim interaction, with the scope change reflecting that injected MIME headers affect the outgoing message and downstream recipients rather than only the Roundcube host. The high score is driven largely by S:C and I:H (header injection = integrity of the composed message). No EPSS score was supplied, and KEV status is not set, so there is no evidence of active exploitation - treat it as 'no public exploit identified at time of analysis.' No POC was provided either, though the upstream fix commit includes a detailed regression test (injecting 'test/test\r\nX-Inject:test') that effectively documents the exploitation technique and lowers the bar for weaponization. Net: real priority for Roundcube operators because it is default-feature, authenticated-but-low-privilege, and patched upstream; it is NOT an unauthenticated RCE and the actual data-integrity/confidentiality impact (C:L) is modest, so it ranks below internet-facing pre-auth flaws. Note the signal gap explicitly: EPSS and KEV data are absent from the input, so widespread-exploitation likelihood cannot be quantified from the provided data.

A remote attacker who holds a valid, low-privilege Roundcube mailbox account composes an HTML email containing an inline image embedded as a data URI, and places CRLF sequences inside the image's media type (e.g. 'data:image/png\r\nX-Inject:evil;base64,...'). Because extract_inline_images() used that media type to build the MIME part without validation, the attacker-controlled CRLF injects arbitrary MIME part headers into the outgoing message. No public exploit is identified, but the upstream fix commit ships a regression test that demonstrates the exact injection payload.