{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/webmail--1.6.20-1.7.x--1.7.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:roundcube:webmail:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.1,"id":"CVE-2026-113386"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Webmail (\u003c 1.6.20, 1.7.x \u003c 1.7.5)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","imap","injection"],"_cs_type":"advisory","_cs_vendors":["Roundcube"],"content_html":"\u003cp\u003eRoundcube Webmail versions before 1.6.20 and 1.7.x before 1.7.5 contain a vulnerability that permits IMAP command injection. This issue occurs due to improper sanitization of user-supplied input within the _uid parameter when processed by the application's mail/headers and mail/viewsource actions. A remote authenticated attacker can leverage this flaw by injecting Carriage Return Line Feed (CRLF) sequences into the targeted parameter.\u003c/p\u003e\n\u003cp\u003eSuccessful exploitation allows the attacker to bypass application logic and send arbitrary commands to the IMAP server associated with the webmail instance. This may lead to unauthorized access to email data, manipulation of mailbox structures, or potential exposure of sensitive information stored on the backend mail server. Security teams should prioritize patching affected instances to the specified secure versions to mitigate this risk.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker gains authenticated access to a vulnerable Roundcube Webmail instance.\u003c/li\u003e\n\u003cli\u003eThe attacker identifies the mail/headers or mail/viewsource actions as endpoints that process the _uid parameter.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request targeting one of these actions.\u003c/li\u003e\n\u003cli\u003eThe attacker injects malicious CRLF sequences into the _uid parameter string.\u003c/li\u003e\n\u003cli\u003eThe application fails to sanitize the input, passing the injected payload to the backend IMAP communication layer.\u003c/li\u003e\n\u003cli\u003eThe IMAP server interprets the injected CRLF sequences, executing the attacker-supplied IMAP commands in the context of the user's session.\u003c/li\u003e\n\u003cli\u003eThe attacker exfiltrates or manipulates mailbox data through the unauthorized IMAP operations.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows an authenticated attacker to execute arbitrary commands against the backend IMAP server. This can result in unauthorized access to private emails, modification of mailbox contents, and a breach of data confidentiality for users within the organization. While this requires authentication, the impact is severe for multi-user email environments where an attacker might compromise one account to gain unauthorized access to mail data or perform lateral movement within the mail infrastructure.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Roundcube Webmail to version 1.6.20 or 1.7.5 or later immediately.\u003c/li\u003e\n\u003cli\u003eMonitor web server access logs for anomalous HTTP requests to the mail/headers and mail/viewsource endpoints containing CRLF characters or abnormal IMAP command syntax in the _uid parameter.\u003c/li\u003e\n\u003cli\u003eReview web application firewall (WAF) logs for blocked requests attempting to inject line-breaking characters into URL query parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-20T06:34:38Z","date_published":"2026-10-20T06:34:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-roundcube-imap-injection/","summary":"Roundcube Webmail versions prior to 1.6.20 and 1.7.5 are vulnerable to IMAP command injection via CRLF sequences in the _uid parameter, allowing authenticated remote attackers to execute arbitrary IMAP commands.","title":"IMAP Command Injection in Roundcube Webmail","url":"https://feed.craftedsignal.io/briefs/2026-10-roundcube-imap-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - Webmail (\u003c 1.6.20, 1.7.x \u003c 1.7.5)","version":"https://jsonfeed.org/version/1.1"}