CVE-2026-113386

Katalog CVE

CVSS 7.1 · High

Kerentanan Improper Neutralization of CRLF Sequences ('CRLF Injection'). Skor CVSS 3.1 7.1 (High) menurut mitre.org.

Deskripsi (NVD)

Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection. A remote authenticated attacker can exploit this via CRLF sequences injected into the _uid parameter of the mail/headers and mail/viewsource actions to execute arbitrary IMAP commands.

Rincian

Terbit di NVD

20 Oktober 2026

Terakhir diubah

20 Oktober 2026

Status NVD

Received

CVSS 3.1

7.1 (High), sumber mitre.org
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://bugs.debian.org/1151279
• https://github.com/roundcube/roundcubemail/commit/004adaaeca4f6799715a54d12e3f657f19efcc9a
• https://github.com/roundcube/roundcubemail/commit/bf5bc0266a8cd16be6b640409e64a6c6c2705049
• https://github.com/roundcube/roundcubemail/commit/f62879defc0330ae240c72b83b2d00a8ab337447
• https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
• https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
• https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5