Roundcube Webmail: Mail header injection via inline image media type
Summary
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 does not validate the media type of inline images embedded as data URIs in composed messages. An authenticated user can place CRLF sequences in that media type to inject arbitrary MIME part headers into the outgoing message. The attack requires a valid mailbox login, and the impact is limited to the integrity of the structure of outgoing mail.
Affected
- Roundcube Webmail 1.6.0 to before 1.6.20
- Roundcube Webmail 1.7.0 to before 1.7.5
- Other distributions and appliance builds: Unknown.
Fixed in
- Roundcube Webmail 1.6.20
- Roundcube Webmail 1.7.5
- Debian trixie: 1.6.20+dfsg-0+deb13u1 (secondary source)
Workaround
- No vendor workaround known. Update is the recommended remedy.
- Restrict which users hold webmail accounts and review unusual outgoing mail until patched.
Exploitation
- No evidence of exploitation in the wild known.
- No public proof of concept known.
- CISA SSVC: Exploitation none, Automatable no.
Our recommendation
- Update all productive Roundcube 1.6.x and 1.7.x installations to 1.6.20 or 1.7.5 (or the vendor's patched package).
- Check whether your Roundcube instance is reachable from the internet and whether your distribution has shipped the fix.
- Review outgoing mail logs for unusual headers while the update is pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Roundcube security updates 1.6.20 and 1.7.5 roundcube.net
- Roundcube release 1.6.20 github.com
- Roundcube release 1.7.5 github.com
- Upstream fix commit 7f3cc9c github.com
- Upstream fix commit adb9b9b github.com
- Debian bug 1151279 bugs.debian.org
- Debian security tracker for roundcube security-tracker.debian.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 10:15.
Original description (NVD)
Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability. rcmail_sendmail::extract_inline_images() used the media type taken from an inline image data URI without validating it, so a remote authenticated attacker could inject arbitrary MIME part headers into the outgoing message by placing CRLF sequences in that media type. Upstream fixed this in the commit “Fix mail header injection via media type in an inline image data URI”, which validates the media type with rcube_mime::is_mimetype_valid().
NVD references (6)
- https://bugs.debian.org/1151279
- https://github.com/roundcube/roundcubemail/commit/7f3cc9cacb16cb3ab047fe8e3cba81db2023cdfc
- https://github.com/roundcube/roundcubemail/commit/adb9b9b3fd43e30af1c166b79494726d89f828eb
- https://github.com/roundcube/roundcubemail/releases/tag/1.6.20
- https://github.com/roundcube/roundcubemail/releases/tag/1.7.5
- https://roundcube.net/news/2026/10/19/security-updates-1.6.20-and-1.7.5
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.