Mailgates CVE-2026-6351

CRLF (Carriage Return Line Feed) injection (CWE-93) occurs when applications fail to sanitize user-controlled input before inserting it into HTTP headers or other protocol streams. Attackers inject newline characters (\r\n) to manipulate HTTP responses, enabling header injection, HTTP response splitting, or-as demonstrated here-unauthorized file access. MailGates and MailAudit are enterprise email security and archiving solutions from Taiwan-based Openfind Information Technology. The vulnerability likely resides in web-facing administrative interfaces or email processing components where user input is improperly incorporated into HTTP response headers. By injecting CRLF sequences, attackers can break out of header context and craft responses that disclose file contents through techniques like path traversal combined with response manipulation. The affected CPE strings indicate all versions of both products are vulnerable until specific patch versions are applied.