Roundcube Webmail EUVD-2026-107885

Requires an authenticated Roundcube session (PR:L) with access to the standard mail/mark action, which is available to all normal logged-in users - no special or non-default configuration is needed, and default installations of affected versions (before 1.6.20 and 1.7.x before 1.7.5) are vulnerable. The attacker must be able to inject raw CRLF (control) characters into the _flag parameter; the fix rejects flags containing control, whitespace and IMAP-special characters. The primary limiting factor is the authentication requirement: anonymous/unauthenticated remote attackers cannot exploit this, so realistic risk centers on credentialed users, compromised accounts, or malicious insiders rather than opportunistic internet-wide scanning.

CVSS 3.1 base score is 7.1 (High) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N: network-reachable, low attack complexity, no user interaction, but PR:L means a valid authenticated Roundcube account is required. No EPSS score was supplied in the input and the CVE is not listed in CISA KEV, so there is no public-data signal of active, widespread exploitation. No public exploit code was identified, though the vendor patch commit (6c3c189) explicitly discloses the sink (the modFlag() function in rcube_imap_generic.php) and the exact injection vector, which materially lowers the bar for an attacker to derive a working exploit. Net assessment: a genuine High-severity integrity issue rather than an inflated high-CVSS item, but the authentication requirement (PR:L) and absence of KEV/EPSS signals place it in the 'patch promptly, not emergency' tier - most dangerous as a post-credential-compromise or malicious-insider escalation primitive rather than a mass-exploitable unauthenticated flaw.

An attacker holding valid webmail credentials (their own account or phished/compromised ones) issues a crafted mail/mark request embedding CRLF sequences in the _flag parameter, smuggling additional IMAP commands into the backend IMAP session. No public exploit was identified at time of analysis, but the published fix commit reveals the precise injection point, so a proof-of-concept is straightforward to construct. Because the CVSS vector is AC:L/UI:N, exploitation is reliable and requires no victim interaction once authenticated.