{"id":"CVE-2026-114716","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-114716","generatedAt":"2026-10-27T23:59:14.383Z","title":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote…","description":"Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().","published":"2026-10-22T02:16:59.000Z","lastModified":"2026-10-26T17:17:16.000Z","status":"Undergoing Analysis","sourceIdentifier":"cve@mitre.org","cvss":{"version":"3.1","score":8.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:N"},"cwe":["CWE-99"],"affected":[],"epss":{"score":0.00391,"percentile":0.3295,"date":"2026-10-26","history":[{"date":"2026-10-22","score":0.0039,"percentile":0.31945}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"new","label":"New CVE","at":"2026-10-22T02:16:59.000Z","detail":{"score":"8.5","severity":"HIGH","publishedAt":"2026-10-22T02:16:59.077Z"},"summary":"New CVE, high severity (CVSS 8.5)."}],"references":[{"url":"https://bugs.debian.org/1151279","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047fe8e3cba81db2023cdfc","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.6.20","source":"cve@mitre.org"},{"url":"https://github.com/roundcube/roundcubemail/releases/tag/1.7.5","source":"cve@mitre.org"},{"url":"https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5","source":"cve@mitre.org"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-114716","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}